FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
jankit6
Staff
Staff
Article Id 418013
Description This article describes how to resolve an issue where RabbitMQ disk space continues to increase because gateway messages are not being consumed by the system.
Scope FortiSOAR v7.6.1 and later.
Solution

If the RabbitMQ partition '/var/lib/rabbitmq' shows high disk usage that continues to grow, follow the steps below to identify and resolve the issue:

 

  1. Check the RabbitMQ queue:

 

rabbitmqctl list_queues -p intra-cyops

 

Review the message count for 'cyops.gateway.crudhub.data'.

If the number of messages is very high, proceed with the next steps.

 

  1. Verify the Audit logs: /var/log/cyops-gateway/gateway.log

In case of an error similar to the one below, it indicates that the message size exceeds the configured limit:

 

java.lang.IllegalStateException: Message body is too large (69320449), maximum configured size is 67108864.

 

Perform the steps below to fix the issue:

 

  1. Backup the configuration file:

 

cp -p /opt/cyops/configs/cyops-gateway/gateway.properties /opt/cyops/configs/cyops-gateway/gateway.properties_bkp

 

  1. Edit the configuration file to increase the size limit (default is 64): Add or modify the following line.

 

vi /opt/cyops/configs/cyops-gateway/gateway.properties

max_inbound_message_body_size=128

 

  1. Save the file and restart the service:

 

systemctl restart cyops-tomcat

 

  1. Validate the fix:

     

Recheck the queue. The message count should begin to decrease gradually as messages are consumed, eventually freeing up RabbitMQ disk space.