IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Cb Response Server Disk Full Due To Large Files on Disk

Cb Response Server Disk Full Due To Large Files on Disk

Version

Cb Response 4.x, 5.x, 6.x

Issue

Services won't start due to a file outside of /var/cb/data taking up excessive disk space

Symptoms

df -h shows 100% of disk space used

Solution

  1. Remove common large files from Cb Response server
    1. Check for old hprof files (hprof files are stack traces from java when SOLR crashes):
      find /var/log/cb -type f -iname "*.hprof.*"
      1. Remove any that are found:
        rm -f {full path}/*hprof.old
    2. Check for old cbdiags:
      find / -type f -iname "cbdiag*"
      1. Remove any that are found:
        rm -f {full path}/*.cbdiag
        Warning: Do not delete the cbdiag utility /usr/share/cb/cbdiag
    3. If if /var is near full:
      yum clean all
      1. If this resolved the space issue, verify yum caching option is not turned on:
        vi /etc/yum.conf
        keepcache=0
  2. Verify there is free space and Cb Response isn't what's taking up space:
    1. Verify you've freed up some space:
      df -h
    2. If disk usage is still near 100%, verify that SOLR and Modulestore aren't taking up all the disk space:
      du -h /var/cb/data/ --max-depth=1
      Note: If this directory is taking up the majority of space, follow this guide: No Free Disk Space Prevents Cb Response Services From Starting
  3. Otherwise check for other files outside of Cb Response. This will give you the 25 largest files:

    Warning: Use caution when deleting any files

    du -k --max-depth=1 | sort -nr | awk 'BEGIN {split("KB,MB,GB,TB", Units, ",");}{u = 1;while ($1 >= 1024) {$1 = $1 / 1024; u += 1} $1 = sprintf("%.1f %s", $1, Units); print $0;} '
    Note: You can use explainshell.com to make sense of long commands like this, such as:
    http://explainshell.com/explain?cmd=du+-k+--max-depth%3D1+%7C+sort+-nr+%7C+awk+%27BEGIN+%7Bsplit%28%...
Labels (1)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎08-21-2017
Views:
3289
Contributors