For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

raydakis10's avatar
raydakis10
Icon for Cirrus rankCirrus
Mar 13, 2020
Solved

I2600 partition / has 0% free

Hi guys,

 

I have full partition error on my cluster i2600. version 13.1.3 (LTM+APM) : partition / has 0% free.

we publish an internet website with wilcard certificate

The system is continuously writing "tmp.*" files in /tmp directory.

output :

[root@xxxx:Active:In Sync] config # ls -l /tmp | more 

-rw-------. 1 root  root   2285 2020-03-12 04:59 tmp.000gWvi8JI

-rw-------. 1 root  root   2175 2020-03-12 02:53 tmp.002w6IsXuI

-rw-------. 1 root  root   2175 2020-03-11 16:25 tmp.0071mRRhse

-rw-------. 1 root  root   1935 2020-03-12 04:25 tmp.007PoiLZeb

-rw-------. 1 root  root   2285 2020-03-12 00:49 tmp.00FQkoxEhd

-rw-------. 1 root  root   2175 2020-03-11 22:59 tmp.00hCFKtTom

-rw-------. 1 root  root   2285 2020-03-12 04:21 tmp.00lIzmtrc2

-rw-------. 1 root  root   1935 2020-03-12 02:08 tmp.00mKYTFbgV

-rw-------. 1 root  root   1935 2020-03-12 01:30 tmp.00pL18KaVg

 

When i opened one the "tmp.*" file i can see it is a certificat.

after deleting the "tmp.*" files, the F5 is still writing anothers files in this directory.

Is Anyone had experience same issue ?

Please advice,

 

Thanks,

 

Leon

 

application delivery
BIG-IP
BIG-IP Access Policy Manager (APM)
  • raydakis10's avatar
    raydakis10
    Mar 30, 2020

    Hello guys,

     

    The issue was resolved after opening ticket with F5 support.

    The matter was the PKI external monitor script . this script used to write temporary certitifcate

    in /tmp for comparizon.

    symptoms of the issue was creation of /tmp/tmp.XXXX files. In order to find responsible process F5 support used auditd : auditctl -w /tmp

    and then search entries /var/log/auditd/audit.log.

    we correct the script.

    Now / partition is OK.

     

    Thanks to all of you

6 Replies

  • Sammi's avatar
    Sammi
    Icon for Altocumulus rankAltocumulus
    Mar 13, 2020

    I can't help with why certificates are saved to the tmp directory, but you might get a few tips on how to clear disk space on the BIG-IP from this link (if you haven't seen it already): https://support.f5.com/csp/article/K14403

  • Lidev's avatar
    Lidev
    Icon for Nacreous rankNacreous
    Mar 16, 2020

    Hi raydakis10 ,

    I've already seen a similar problem on Devcentral, it was an iRule that creates these junk files. Do you use irules on you F5 BIG-IP ?

  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for Noctilucent rankNoctilucent
    Mar 16, 2020

    Those are just 2 KB files.... Can you please run the below and share us the output.

    df -h

    List top 20 files,

    find /var/tmp -xdev -type f -exec du {} \; | sort -rn | head -20
  • raydakis10's avatar
    raydakis10
    Icon for Cirrus rankCirrus
    Mar 16, 2020

    Hi Lidev,

     

    Yes i have irules on this DMZ F5 .

    Today, i'am working out of the office.

    the directory that is full is /tmp. i'll provide the output of the command ASAP :

    1. find /tmp -xdev -type f -exec du {} \; | sort -rn | head -20

     

    Thanks ,

  • raydakis10's avatar
    raydakis10
    Icon for Cirrus rankCirrus
    Mar 30, 2020

    Hello guys,

     

    The issue was resolved after opening ticket with F5 support.

    The matter was the PKI external monitor script . this script used to write temporary certitifcate

    in /tmp for comparizon.

    symptoms of the issue was creation of /tmp/tmp.XXXX files. In order to find responsible process F5 support used auditd : auditctl -w /tmp

    and then search entries /var/log/auditd/audit.log.

    we correct the script.

    Now / partition is OK.

     

    Thanks to all of you

    • Lidev's avatar
      Lidev
      Icon for Nacreous rankNacreous
      Mar 30, 2020

      Thanks raydakis10 for your feedback on this subject and the tips with auditctl :)