The /opt partition reaches 100% and causes the RSA Security Analytics UI to become unavailalble

[#1]

Article Number

000034517

Applies To

RSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Security Analytics Server, User Interface
RSA Version/Condition: 10.5.x, 10.6.x
 

Issue

The /opt partition becomes full on the RSA Security Analytics server which causes the user interface to become unavailable.

Cause

This is due to the sms.log and its backups occupying most of the space in the /opt directory.

Resolution

To resolve the issue, follow the steps below.

1. Connect to the Security Analytics server appliance via SSH as the root user.
2. Navigate to the /opt/rsa/sms/logs directory and delete the older backups of the sms.log file.
3. Once finished, restart the sms and jetty services with the commands below.

   service rsa-sms restart
   restart jettysrv

4. Once the user interface is once again accessible, navigate to Administration -> System -> System Logging -> Settings and reduce the number of backup files as shown below.
    

​Image description