I2600 partition / has 0% free

[raydakis10]

Hi guys,

I have full partition error on my cluster i2600. version 13.1.3 (LTM+APM) : partition / has 0% free.

we publish an internet website with wilcard certificate

The system is continuously writing "tmp.*" files in /tmp directory.

output :

[root@xxxx:Active:In Sync] config # ls -l /tmp | more 

-rw-------. 1 root  root   2285 2020-03-12 04:59 tmp.000gWvi8JI

-rw-------. 1 root  root   2175 2020-03-12 02:53 tmp.002w6IsXuI

-rw-------. 1 root  root   2175 2020-03-11 16:25 tmp.0071mRRhse

-rw-------. 1 root  root   1935 2020-03-12 04:25 tmp.007PoiLZeb

-rw-------. 1 root  root   2285 2020-03-12 00:49 tmp.00FQkoxEhd

-rw-------. 1 root  root   2175 2020-03-11 22:59 tmp.00hCFKtTom

-rw-------. 1 root  root   2285 2020-03-12 04:21 tmp.00lIzmtrc2

-rw-------. 1 root  root   1935 2020-03-12 02:08 tmp.00mKYTFbgV

-rw-------. 1 root  root   1935 2020-03-12 01:30 tmp.00pL18KaVg

When i opened one the "tmp.*" file i can see it is a certificat.

after deleting the "tmp.*" files, the F5 is still writing anothers files in this directory.

Is Anyone had experience same issue ?

Please advice,

Thanks,

Leon

[Sammi]

I can't help with why certificates are saved to the tmp directory, but you might get a few tips on how to clear disk space on the BIG-IP from this link (if you haven't seen it already): https://support.f5.com/csp/article/K14403

[Lidev]

Hi raydakis10 ,

I've already seen a similar problem on Devcentral, it was an iRule that creates these junk files. Do you use irules on you F5 BIG-IP ?

[jaikumar_f5]

Those are just 2 KB files.... Can you please run the below and share us the output.

df -h

List top 20 files,

find /var/tmp -xdev -type f -exec du {} \; | sort -rn | head -20

[raydakis10]

Hi Lidev,

Yes i have irules on this DMZ F5 .

Today, i'am working out of the office.

the directory that is full is /tmp. i'll provide the output of the command ASAP :

1. find /tmp -xdev -type f -exec du {} \; | sort -rn | head -20

Thanks ,

[raydakis10 · Accepted solution]

Hello guys,

The issue was resolved after opening ticket with F5 support.

The matter was the PKI external monitor script . this script used to write temporary certitifcate

in /tmp for comparizon.

symptoms of the issue was creation of /tmp/tmp.XXXX files. In order to find responsible process F5 support used auditd : auditctl -w /tmp

and then search entries /var/log/auditd/audit.log.

we correct the script.

Now / partition is OK.

Thanks to all of you

[Lidev]

Thanks raydakis10 for your feedback on this subject and the tips with auditctl 🙂