Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Disk On Server Full Due To Large Files

EDR: Disk On Server Full Due To Large Files

Environment

  • EDR Server: All Versions (formerly CB Response)

Symptoms

  • EDR Server services will not start
  • 'df -h' command reports partition(s) with 100% disk space used

Cause

Excessive disk space usage from files outside of /var/cb/data directory.

Resolution

  • Remove common large files from EDR server
    • .hprof files (stack traces associated with SOLR crashes):
      1. Check for presence of .hprof files
        • find /var/log/cb -type f -iname "*.hprof.*"
  1. Remove any .hprof files found:
    • rm -f {full path}/*hprof.old
  • Diagnostic files
  1. Check for presence of diagnostic files
    • find / -type f -iname "cbdiag*"
  2. Remove any diagnostic files found:
    • rm -f {full path}/*.cbdiag
  • RPM files
  1. Remove RPM files from yum repository
    • yum clean all
  2. Disable yum caching option:
a. vi /etc/yum.conf file
b. Add or modify following parameter/value: keepcache=0

Additional Notes

If disk usage is still near 100%, following command will help determine if SOLR or Modulestore are accounting for disk space usage:
 

du -h /var/cb/data/ --max-depth=1

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-02-2019
Views:
2774
Contributors