NetWitness: /opt Partition Reaches 100% and Causes NetWitness Admin UI to Become Unavailable

Issue

The /opt partition becomes full on the NetWitness Admin server which causes the user interface to become unavailable.

Cause

This is due to the sms.log and its backups occupying most of the space in the /opt directory.

Resolution

1. Connect to the NetWitness Admin Server appliance via SSH as the root user.
2. Navigate to the /opt/rsa/sms/logs directory and delete the older backups of the sms.log file. Example of logs to be removed:
   [root@SAServer logs]# pwd
   /opt/rsa/sms/logs
   [root@SAServer logs]# ll
   total 48484
   drwxr-xr-x. 2 root root 23 Nov 7 2023 audit
   -rw-r--r--. 1 root root 2946118 Aug 23 12:04 les.log
   -rw-r--r--. 1 root root 20971552 Jul 13 20:52 les.log.1
   -rw-r--r--. 1 root root 385536 Jul 24 23:56 sms-2024-07-24.0.log
   -rw-r--r--. 1 root root 406922 Jul 25 23:56 sms-2024-07-25.0.log
   -rw-r--r--. 1 root root 393218 Jul 26 23:56 sms-2024-07-26.0.log
   -rw-r--r--. 1 root root 393663 Jul 27 23:56 sms-2024-07-27.0.log
   -rw-r--r--. 1 root root 389422 Jul 28 23:56 sms-2024-07-28.0.log
   -rw-r--r--. 1 root root 396880 Jul 29 23:56 sms-2024-07-29.0.log
   -rw-r--r--. 1 root root 459123 Jul 30 23:56 sms-2024-07-30.0.log
   -rw-r--r--. 1 root root 498651 Jul 31 23:56 sms-2024-07-31.0.log
   -rw-r--r--. 1 root root 533747 Aug 1 23:58 sms-2024-08-01.0.log
3. Once finished, restart the sms and jetty services with the commands below.
   service rsa-sms restart
   restart jettysrv
4. Once the user interface is once again accessible, navigate to Administration -> System -> System Logging -> Settings and reduce the number of backup files as shown below.
    

Product Details

Approval Reviewer Queue

Technical approval queue