- The \/opt\/panlogs disk partition is high<\/li><\/ul>\n\n\n\n
> show system disk-space\n\nFilesystem Size Used Avail Use% Mounted on\n\/dev\/root 7.0G 4.1G 2.6G 62% \/\nnone 3.2G 92K 3.2G 1% \/dev\n\/dev\/sda5 16G 2.4G 13G 16% \/opt\/pancfg\n\/dev\/sda6 8.0G 3.2G 4.4G 43% \/opt\/panrepo\ntmpfs 2.2G 1.7G 492M 78% \/dev\/shm\ncgroup_root 3.2G 0 3.2G 0% \/cgroup\n\/dev\/sda8 125G 115G 3.7G 97% \/opt\/panlogs <----- Shows above 95%<\/strong><\/em>\n<\/pre>\n\n\n\n
Environment<\/strong><\/p>\n\n\n\n
- Palo Alto Firewall<\/li><\/ul>\n\n\n\n
Resolution<\/strong><\/p>\n\n\n\n
- To reduce disk usage instantly, delete all logs for a given log type (logs can not be deleted according to the date<\/em>). <\/li>
- The following logs can be cleared
- Traffic logs<\/li>
- Threat, URL, and Data Logs<\/li>
- Configuration logs<\/li>
- System logs<\/li>
- HIP Match logs<\/li>
- GlobalProtect logs<\/li>
- Alarm logs<\/li>
- Tunnel, GTP logs<\/li>
- User-ID logs<\/li>
- IP-Tag logs<\/li>
- Authentication logs<\/li>
- Decryption logs<\/li>
- ACC database (CLI command only)<\/li>
- SCTP logs (CLI command only)<\/li><\/ul><\/li><\/ul>\n\n\n\n
Clear logs via the WebGUI<\/strong><\/h3>\n\n\n\n
- Device > Log Setting ><\/strong> Scroll down to Manage Logs<\/strong>.<\/li><\/ol>\n\n\n\n
<\/figure>\n\n\n\n
- Click the log type you want to clear and click YES <\/strong>to confirm the request.<\/li><\/ol>\n\n\n\n
<\/figure>\n\n\n\n
Clear logs via the CLI<\/strong><\/h3>\n\n\n\n
- Log into CLI<\/li>
- Use the clear log<\/strong> command to clear the log type you want, then confirm.admin@PAN> clear log<\/strong> > acc ACC database > alarm Alarm logs > auth Authentication logs > config Configuration logs > decryption Decryption logs > globalprotect GlobalProtect logs > gtp Tunnel and GTP logs > hipmatch Hipmatch database > iptag Iptag logs > sctp SCTP logs > system System logs > threat Threat logs > traffic Traffic logs > userid User-ID logs (Example clearing hipmatch log)<\/em><\/strong> admin@PAN> clear log hipmatch<\/strong> Hipmatch database will be removed. Do you want to continue? (y or n) Note<\/strong>: Clearing the threat<\/strong> log also clears the URL log.
<\/li><\/ol>\n\n\n\nIf none of the above remediation steps resolve the issue, it is recommended to collect the following Troubleshooting Data<\/strong> below and open a Support Case.<\/p>\n\n\n\n
- Collect Tech Support File<\/strong> (GUI<\/strong>: Device > Support Click<\/strong> Generate Tech Support File)<\/li>
- Collect the output of the CLI show system disk-space <\/li><\/ol>\n\n\n\n
Additional Information<\/strong><\/p>\n\n\n\n
- To prevent logs from filling up \/opt\/panlogs Disk quota can be utilized and adjusted. (Device > Setup ><\/strong> scroll down to Logging and Reporting Settings)<\/strong>
- Logs are purged when the quota is exceeded, so it is recommended not to allocate more than 95% of the space to allow some buffer space. Set the “Max Days<\/strong>” (Retention Period) so that log purging operation works seamlessly and prevents the disk from filling up. See How to Determine How Much Disk Space is Allocated to Logs<\/a><\/li><\/ul><\/li><\/ul>\n\n\n\n
Ref: https:\/\/knowledgebase.paloaltonetworks.com\/KCSArticleDetail?id=kA10g000000ClSjCAK<\/p>\n","protected":false},"excerpt":{"rendered":"
Symptom The \/opt\/panlogs disk partition is high > show system disk-space Filesystem Size Used Avail Use% Mounted on \/dev\/root 7.0G 4.1G 2.6G 62% \/ none 3.2G 92K 3.2G 1% \/dev \/dev\/sda5 16G 2.4G 13G 16% \/opt\/pancfg \/dev\/sda6 8.0G 3.2G 4.4G 43% \/opt\/panrepo tmpfs 2.2G 1.7G 492M 78% \/dev\/shm cgroup_root 3.2G 0 3.2G 0% \/cgroup \/dev\/sda8 Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[13,9],"tags":[1179,1180],"class_list":["post-4154","post","type-post","status-publish","format-standard","hentry","category-firewalls","category-networks","tag-clear-logs-palo-alto","tag-increase-disk-space-palo-alto-firewall"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t
- Logs are purged when the quota is exceeded, so it is recommended not to allocate more than 95% of the space to allow some buffer space. Set the “Max Days<\/strong>” (Retention Period) so that log purging operation works seamlessly and prevents the disk from filling up. See How to Determine How Much Disk Space is Allocated to Logs<\/a><\/li><\/ul><\/li><\/ul>\n\n\n\n
- Collect the output of the CLI show system disk-space <\/li><\/ol>\n\n\n\n
- Collect Tech Support File<\/strong> (GUI<\/strong>: Device > Support Click<\/strong> Generate Tech Support File)<\/li>
- Click the log type you want to clear and click YES <\/strong>to confirm the request.<\/li><\/ol>\n\n\n\n
- Device > Log Setting ><\/strong> Scroll down to Manage Logs<\/strong>.<\/li><\/ol>\n\n\n\n
- The following logs can be cleared
- To reduce disk usage instantly, delete all logs for a given log type (logs can not be deleted according to the date<\/em>). <\/li>
- Palo Alto Firewall<\/li><\/ul>\n\n\n\n