Disk space filling up

[shnsys]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

32GB

Storage for /

200GB

Storage for /nsm

118GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

We noticed that the /nsm directory is filling up. We followed the fix from #2615 but couldn’t find the log_size_limit in /opt/so/saltstack/local/pillar/minions/$nodename_standalone.sls.

Could you please let us know the steps to configure log rotation or any other option to resolve this issue?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

Hello and welcome to the Security Onion Discussion Forum!

We followed the fix from #2615 but couldn’t find the log_size_limit in /opt/so/saltstack/local/pillar/minions/$nodename_standalone.sls.

#2615 is an old discussion from 2021 for an older version of Security Onion. That guidance does not apply to the current version of Security Onion 2.4.

Could you please let us know the steps to configure log rotation or any other option to resolve this issue?

Guidance for the current version of Security Onion 2.4 can be found in the FAQ and other sections of the documentation:
https://docs.securityonion.net/en/2.4/faq.html#why-is-my-disk-filling-up
https://docs.securityonion.net/en/2.4/stenographer.html#disk-free-percentage
https://docs.securityonion.net/en/2.4/elasticsearch.html#index-management