search

PaloAltoNetworks / minemeld

Main MineMeld documentation repo
379 stars 64 forks source link

Minemeld trace folder taking a big chunk of disk space causing minemeld not to start #59

Closed joaopsys closed 3 years ago

joaopsys commented 3 years ago

Describe the bug

I wouldn't say this is exactly a bug, so apologies in advance since I didn't really know where to report this one.

Minemeld 0.9.70 is not coming up, I believe due to available disk space. It is stuck in a restart loop and there are no errors in minemeld-engine.log

However minemeld-traced.log shows:

2021-01-04T16:04:48 (26609)writer._run CRITICAL: Disk space used above threshold (70%), writing disabled

After digging around what exactly was taking this much space, I came to the conclusion that it is mostly /opt/minemeld/local/trace taking more than 9GB of disk space.

How should I take care of this one? Is there a reason why this folder needs to take ~9GB of space? Can I clean it up? If so, how should I do that (i.e. is there any minemeld command that I should run or just I just rm -rf?)

I appreciate the support, Best regards,

joaopsys commented 3 years ago

I ended up using the /opt/minemeld/engine/current/bin/mm-traced-purge utility. Unfortunately it didn't fix my issue and Minemeld is still in a restart loop (looks like a SIGTERM is sent and it restarts automatically). Either way, I'll have to figure it out on my own.