000034517 - The /opt partition reaches 100% and causes the RSA Security Analytics UI to become unavailalble

Document created by RSA Customer Support Employee on Dec 29, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000034517
Applies ToRSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Security Analytics Server, User Interface
RSA Version/Condition: 10.5.x, 10.6.x
IssueThe /opt partition becomes full on the RSA Security Analytics server which causes the user interface to become unavailable.
CauseThis is due to the sms.log and its backups occupying most of the space in the /opt directory.
ResolutionTo resolve the issue, follow the steps below.
  1. Connect to the Security Analytics server appliance via SSH as the root user.
  2. Navigate to the /opt/rsa/sms/logs directory and delete the older backups of the sms.log file.
  3. Once finished, restart the sms and jetty services with the commands below.
    service rsa-sms restart
    restart jettysrv

  4. Once the user interface is once again accessible, navigate to Administration -> System -> System Logging -> Settings and reduce the number of backup files as shown below.