FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
kdave
Staff
Staff
Article Id 302895
Description This article describes how to troubleshoot issues related to the '/' (root) partition being full.
Scope FortiSIEM
Solution

Check and verify the space in the root partition using the following command:

 

df -h

 

Mount the root  partition with /mnt:

 

mount -o bind / /mnt

 

Change the directory to /mnt:

 

cd /mnt

 

Run the following command to check what is utilizing more space in /mnt:

 

du --max-depth=3 -xh /mnt | sort -hr | head -n 20

 

Analyze the directory and the content occupying a larger space.

 

Take a backup or copy content using the following rsync command:

 

rsync -a --progress /<source_directory> /<destination_directory>

 

Replace /<source_directory>, /<destination_directory> with the actual source and destination directory without the <,> symbols

 

Remove the content of the source directory using the following command. This will free up space occupied by larger directories present in the / partition.

 

rm -rf <source_directory>/*

 

Check again for the space available in the root partition.

 

df -h

 

Finally, when there is a sufficient amount of space available in the root partition, unmount the root partition from /mnt:

 

cd ~

umount /mnt

Contributors