SM 10.1 - Disk usage for partition /var/log/audit is 90% - OP_MRES20551,MIN alarmon Session Manager.

Alarms related to OP_MRES20551,MIN, Session Manager 10.1.x and the /var/log/audit directory

This how to will help you with viewing directories related to the OP_MRES20551 alarm that can occur within Avaya Aura System Manager.

Solution:

1) Login into the SM CLI with "cust" account

2) Use the command df-kh to evaluate the size of the /var/log/audit directory

user@sys01mgmt-$ df -kh
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/smgrvg01-lv_root 3.9G 2.1G 1.9G 52% /
devtmpfs 4.4G 0 4.4G 0% /dev
tmpfs 4.4G 4.0K 4.4G 1% /dev/shm
tmpfs 4.4G 457M 3.9G 11% /run
tmpfs 4.4G 0 4.4G 0% /sys/fs/cgroup
/dev/sdb 25G 159M 25G 1% /perfdata
/dev/sdc 15G 139M 15G 1% /emdata
/dev/sdd 25G 1.7G 22G 8% /swlibrary
/dev/mapper/smgrvg01-lv_tmp 1.5G 33M 1.4G 3% /tmp
/dev/mapper/smgrvg01-lv_var 4.3G 576M 3.7G 14% /var
/dev/sda1 509M 132M 377M 26% /boot
/dev/mapper/smgrvg01-lv_var_log 1.8G 1.5G 347M 81% /var/log
/dev/mapper/smgrvg01-lv_opt 6.8G 4.2G 2.6G 62% /opt
/dev/mapper/smgrvg01-lv_home 1.8G 370M 1.4G 21% /home
/dev/mapper/smgrvg01-lv_data 14G 976M 13G 7% /var/lib/pgsql/data
/dev/mapper/smgrvg01-lv_var_log_audit 1.8G 1.62G 200M 91% /var/log/audit
tmpfs 884M 0 884M 0% /run/user/779

3) If the /var/log/audit director is over 75-80% peform the following steps;

4) Login into the SM CLI with "root" account

4) Navigate to /var/log/audit directory:

5) Run the following command to determine how many files are in the directory ls -al | wc -l

user@sys01mgmt-$ pwd
/var/log/audit
user@sys01mgmt-$ ls -al | wc -l
75

6) The audit log files will rotate and be around 21MB.

7) To cleanup space and remove older audit logs use the following commands. rm -f audit.log.? / rm -f audit.log.?? (Please note! use care when running any command as root)

7) If the total file count exceeds 80 files, use the next command to adjust retention. ( Please be careful to not modify any of the default settings other than "Number of audit files to Retain"

8) Run the following command "setSecurityPolicy" and adjust "Number of audit files to Retain" from 100 Days to 80 Days.

9) Exit out of the terminal session.

This should correct any issues you see with Disk usage for partition /var/log/audit is 90% - OP_MRES20551,MIN alarm.

The threshold alarm kicked in at 75-80% (1.92GB of 2.4GB) Each file is roughly 21MB x 80 files = 1.68GB of 2.4 GB. At 100 files it would have grown to around 2.1 GB.