Technical Tip: CSV Export Files Accumulating in /opt/cyops/configs/integrations/workspace

Description

This article describes the behavior of CSV export files stored in the /opt/cyops/configs/integrations/workspace directory and explains how to manage files that remain after incomplete export operations.

Scope

FortiSOAR.

Solution

The /opt/cyops/configs/integrations/workspace directory is used as a temporary workspace for file processing operations in FortiSOAR.

When records are exported using the Export Records As CSV action, temporary CSV files may be created in this directory with names similar to:

alerts-records-17793xxxxxxxxx.csv

These temporary files are normally removed automatically when the export operation completes successfully.

If the export operation fails, is interrupted, or remains in an In Progress state, the temporary CSV files may remain in the workspace directory and continue consuming disk space.

To verify whether CSV files exist in the workspace directory, run the following command:

ls -lrth /opt/cyops/configs/integrations/workspace

If the files are no longer associated with an active export operation, they can be removed manually with the command below:

rm -rf /opt/cyops/configs/integrations/workspace/alerts-records-17793xxxxxxxxx.csv

If CSV files continue to accumulate, review the corresponding CSV export jobs for failures or incomplete executions.

Note: As a best practice, ensure a recent system backup or VM snapshot is available before making changes to the FortiSOAR appliance.