[Check Point] How to clear the Check Point Management Server /var/log directory when it is full?

Solution

Check Point Management involves overseeing the functioning of the Check Point firewall, including the storage of log traffic that passes through the firewall. Failure to delete old log files can cause the disk space of Check Point Management to become full, resulting in an inability to manage the operation of the firewall. 

Here's how to delete old log files:

1) Access to the Management Server command line interface (CLI) via console/SSH.

2) Access to the expert mode if you are in the default CLISH session.

Hostname> expert

Enter expert password:

Warning! All configurations should be done through CLISH

You are in expert mode now.

[Expert@Hostname:0]#

3) Access to the log file path.

[Expert@Hostname:0]#cd $FWDIR/log

[Expert@Hostname:0]# pwd

/opt/CPsuite-R8x.xx/fw1/log

4) Delete the old log files.

[Expert@Hostname:0]# ls >> this will list all the log files in the system

[Expert@Hostname:0]# rm 2022-02* >> this command will delete all the log files generated in February 2022

5) Deleting additional files.

Sometimes, the /var/log directory might be overwhelmed by other files such as backups, user-generated CPinfo, or any other files that the user might have copied into the /var/log directory.

One thing that you can do is list out which subfolder in /var/log might occupy the storage. The command is:

[Expert@Hostname:0]# du -h --max-depth=1 /var/log

Repeat the command until you can find which directory contains the largest file size.

[Expert@Hostname:0]# du -h --max-depth=1 /var/log/opt

.elg files are used for debugging primarily. If you delete them, new ones will be created when needed.

ptr are log pointer files and are safe to delete if you are deleting .log files anyway. So if ur deleting 2008-01-01-xxx.log, you can safely remove 2008-01-01*xxx.ptr

stats are also safe to remove. New will be created by the system if needed when needed.