Understanding /dev/mapper/rl-root storage FortiSIEM

[gwaihir]

Hello guys, please guide me to understand this little thing.

This is a supervisor all in one deployment with Click house DB (FSM 7.1.X running on Rocky Linux)

As you can see, my /sda partition has 75G, (at first it was 25 GB)

The /dev/mapper/rl-root inside /dev/sda is eating quickly the storage that I assign to it. Why is this happening? is supposed that logs are forwarded to Click house DB in /dev/sde partition tand this should be the more used storage, also /opt is running out of storage. 

This is the second time that I resize the /dev/mapper/rl-root partition. 

Thank you!

[adem_netsys]

Hi @gwaihir 

My disk is 100 percent, I deleted *M files and rebooted, the environment crashed and I came back with snap. /var/crash looks empty. There is something I can't understand why, I don't have much log source because it is my test environment. I will still try to increase the disk value

[gwaihir]

Hi @adem_netsys use this command to analyze differents paths

du -sh /* 2>/dev/null |  sort -n

Then if you see a directory with huge storage then use the command again with the new path, like this:

du -sh /new_path/* 2>/dev/null |  sort -n

This will lead us to find what is happening.