Increasing disk usage - will fill the disk

[cinergi]

Hello,

I'm new to Opnsense and I've been using a new Opnsense installation for ~1.5 months.  During that time, the disk usage has been steadily increasing.  I have default settings for logging in System > Settings > Logging (Enabled, Maximum Preserved Files 31, no maximum size) which I understand should result in retaining only 31 days of logs.  My only significant plugin is AdGuardHome, which I've configured to retain the last 7 days of DNS requests and the last 24 hours of statistics.

My hardware is an HP T620 Plus thin client PC with a 16GB SSD that's currently 75% full and increasing.  At this rate, it will fill the disk in less than 2 weeks.  I also noticed that there's an 8GB swap partition set up by the Opnsense installer (which seems to be the default since I didn't configure it), resulting in only 8GB available to the system which doesn't help.  The "2GB Swap File" option under System > Settings > Miscellaneous is disabled; I'm not sure how this interacts with the 8GB swap partition that was automatically set up during installation.  File system is ZFS.

I don't mind buying a larger SSD if that's the solution, but not if it will simply delay the problem.  Any advice?

Thanks!

[Patrick M. Hausen]

Code: [Select]

cd /
du -skx * | sort -rn
That gives you the largest directory on top.

Code: [Select]

cd <largest directory>
du -skx * | sort -rn
Repeat the last steps until you find what is using all that disk space.

[cinergi]

Thanks Patrick, this put me on the right track.  The offending files seem to be the firewall logs in

/var/log/filter

There are huge (1 Gig +) daily files in that directory.  I have logging disabled for all of my firewall rules, but the automatically generated rules all have logging enabled and I see no way to disable it.  So I guess the only option is to decrease the logging retention interval in System > Settings > Logging.  I thought 31 days is reasonable, but I didn't realize that by default Opnsense has so much firewall logging enabled.

[Patrick M. Hausen]

Firewall > Settings > Logging 

[cinergi]

Thank you, again!