AnsweredAssumed Answered

RSA SA indicates /var/netwitness partition is almost 100% utilization

Question asked by qVIQUb8ls9saNP7igYuIdrmmeXDVxfMDeLjDVSbku70= on Oct 11, 2016
Latest reply on Oct 18, 2016 by Scott Bergman

Hello Everyone ,

 

When I check df -h on SA head i can see my /var/netwitness partition as 98 %

 

/dev/mapper/VolGroup00-nwhome
                       20G   20G  465M  98% /var/netwitness

 

When I examine the contents of /var/netwitness i can see something like below :


[root SA01 netwitness]# ls -lah
total 5.4G
drwxr-xr-x.  8 root root 4.0K Oct  5 01:21 .
drwxr-xr-x. 22 root root 4.0K Feb 22  2016 ..
drwxr-xr-x.  3 root root 8.0K Oct  4 22:37 123
drwxr-xr-x.  3 root root   35 Aug 19 22:15 appliance
drwxr-xr-x.  6 root root   70 Aug 19 22:15 broker
drwxr-xr-x.  3 root root   18 Apr 26 20:52 database
drwxr-xr-x.  3 root root   60 Sep 30 14:56 ipdbextractor
-rw-------.  1 root root   12 Oct 11 07:19 NwBroker.persist
-rw-r--r--.  1 root root 1.8G Oct  4 21:35 ABC.bz2
-rwxr-xr-x.  1 root root 3.6G Oct  4 22:29 XYZ.zip
drwxr-xr-x.  3 root root   16 Apr 26 20:49 srv

 

I didn't find any files in the /var/netwitness partition that could be consuming nearly 20GB of space.

 

Why i'm seeing 98% partition in df -h output ?

 

Thanks in advance !

 

Regards

Pranav

Outcomes