Checking an unusually large .ucs backup file

Recently I noticed a significantly larger .ucs backup file on one of my lab machines.

Usual suspects are the EPSEC files used by APM, but APM was not provisioned here.

So here are the steps taken to check for the largest directories and files in the backup:

 

tmsh save sys ucs backup.bigip182.20220525
mkdir /var/tmp/backupcheck
mv /var/local/ucs/backup.bigip182.20220525.ucs /var/tmp/backupcheck/
cd /var/tmp/backupcheck
tar -zxf backup.bigip182.20220525.ucs
ls -lat
du -a /var/tmp/backupcheck | sort -n -r | head -n 20
find /var/tmp/backupcheck -xdev -type f -exec du {} \; | sort -rn | head -30
cd /var/tmp
rm -rf /var/tmp/backupcheck

 

After creating a new archive it is moved into a temp folder and unzipped/untarred. 

With applying the disk usage (du) utility and the find utility to the temp directory it turned out, the imported AS3 .rpm was saved with the .ucs archive. And this makes sense, of course.

But there might also be tcpdumps stored in your home directory (adding up additional 20MByte to the archive here) or one of the other places stored with the archive, i.e:

 

# find /var/tmp/backupcheck -xdev -type f -exec du {} \; | sort -rn | head -30
46916   /var/tmp/backupcheck/backup.bigip182.20220525.ucs
21076   /var/tmp/backupcheck/var/config/rest/iapps/RPMS.save/f5-appsvcs-3.35.0-4.noarch.rpm
20344   /var/tmp/backupcheck/home/stephanm/test.001.pcap
<snip>