Loading...

Knowledge Center


How to troubleshoot Web Gateway appliance disk space issues
Technical Articles ID:   KB73869
Last Modified:  8/21/2019
Rated:


Environment

McAfee Web Gateway (MWG)

Problem

There is no available disk space on the Web Gateway appliance, and write actions to parts of the file structure fail. This occurrence causes issues with writing to log files, starting services, and the creation of feedback files.

Cause

There are multiple circumstances that can cause the Web Gateway appliance to run out of disk space.

Example scenarios:

  • Connection Tracing was not disabled after troubleshooting was completed.
  • A TCPDUMP was not disabled after troubleshooting was completed.
  • Core File generation was not disabled after troubleshooting was completed.
  • Log Rotation or Log Management was not configured correctly.
  • A large number of unnecessary feedback files remain on the appliance after troubleshooting was completed.

Solution

Perform the following troubleshooting steps to determine the exact cause of the issue, and then make any needed changes:

  1. Log on to the appliance with an SSH client:
    1. Open the SSH client.
    2. In the Host section, type the IP address of the Web Gateway appliance.
    3. Click Open.
  2. Locate any abnormally large files.
  3. Delete files as needed.
  4. Make the necessary configuration changes. Depending on the types of files you have located, you might need to disable or modify certain types of logging or other system output.


To locate large files
The locations that contain large files can help with determining the exact cause of the issue. Use the following command to search for large files without specifying a location:

 
find /opt -type f -size +10000k -exec ls -alsoh {} \;
 
NOTE: Change the 10000K variable as needed:
  • XX000K = XX MB
  • XXX000K = XXX MB
  • X000000K = X GB

The following locations often contain large log and output files due to troubleshooting previous issues:

  • /opt/mwg/log/user-defined-logs
  • /opt/mwg/log/debug/connection_tracing
  • /opt/mwg/log/debug/feedbacks
  • /opt/mwg/log/debug/message_tracing
  • /opt/mwg/log/debug/cores
  • /opt/mwg/log/debug/tcpdump
  • /opt/mwg/log/debug/ruleengine_tracing
Other useful commands for locating large files and directories:
  • ls -lh (list the directory contents)
  • cd (change directory)
  • du -Ph (display filesystem partitions)
  • du -h --max-depth=1 (display current filesystem usage of the current directory)
 
To delete large files
Before you can access the appliance to make configuration changes, you might need to delete files to create available disk space. Use the commands in this section to delete any unnecessary files that you have located.

WARNING: The commands in this section can remove critical parts of the filesystem on your Web Gateway appliance. Improper use can cause the appliance to stop functioning and might require you to re-image the appliance. Ensure that you delete only non-critical files.

Delete commands:

  • rm (remove file)
  • rm -f (force remove file)
  • rm -rf (more powerful force removal)

    IMPORTANT: The rm -rf command can remove full directories and the files contained in those directories. This removal includes the entire mounted filesystem if it is used on the root directory.


Using wild cards for file deletion:
You can use the asterisk (*) wild card to specify multiple characters in a filename. The most common use is to delete multiple files that match a specific pattern.

Examples:
If you have multiple log files in the format systemlogMMDDYYYY.log:

  • rm *.log will remove all files with the .log extension.
  • rm systemlog*.log will remove all files that begin with systemlog and have the .log extension.
  • rm systemlog****2015.log will remove all systemlog files for the year 2015.

McAfee recommends that you use only the following commands if the current directory contains too many files to use the rm command.

To force delete the contents of the current directory, type the following command:

rm -f *

You can also use the find command in conjunction with the rm - f command to remove all files that match a specific pattern in the file name.

IMPORTANT: Before you remove the files, McAfee recommends that you return a list of all the files and verify that they can safely be removed.

Example:
The following command will locate all files that contain .txt in the file name:

find . -type f -name ".txt" -exec ls -l {} \;

After you verify that the files can be safely removed, the command below will force delete the files: 

find . -type f -name ".txt" -exec rm -f {} \;

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.