RedHat Full Drive Notes.md 4.2 KB
RedHat Full Drive Notes
sudo: unable to mkdir /var/log/sudo-io/00/00/08: No space left on device sudo: error initializing I/O plugin sudoers_io
Use AWS Systems Manager to run a bash shell command
rm-rf /var/log/hubble
du -sh /var/log/* |sort -h
du -sh /opt/syslog-ng/* |sort -h
du -sh /opt/
rm -rf /var/log/hubble
#stupid Azure OMS/OMI agent has debug logging turned on!
du -sh /var/opt/microsoft/omsconfig/* |sort -h
rm -rf /var/opt/microsoft/omsconfig/omsconfigdetailed.log
/opt/microsoft/omsagent/bin/service_control restart
tail /var/opt/microsoft/omsconfig/omsconfigdetailed.log
/var/lib/waagent
Azure Agent on AFS POP
/var/cache/yum
yum clean all
afs-splunk-hf.msoc.defpoint.local / prod-afs-splunk-hf (websense runs once per day.) salt afs-splunk-hf.msoc.defpoint.local cmd.run 'ls -larth /opt/websense/json_removal.sh' salt afs-splunk-hf.msoc.defpoint.local cmd.run 'df -h'
DO THIS: HAMMER TIME for i in hosted.gz; do rm -rf "$i"; done ALSO salt afs-splunk-hf.msoc.defpoint.local cmd.run 'sh /opt/websense/json_removal.sh' salt afs-splunk-hf.msoc.defpoint.local cmd.run 'sh /opt/websense/gz_removal.sh' /opt/websense/json_removal.sh rm -rf /opt/websense/hosted_agg04k_41208_116.50.57.190_100_156 rm -rf 165.gz rm -rf hosted_agg04k.gz rm -rf hosted_agg03k.gz rm -rf hosted_agg02k.gz rm -rf hosted_agg01k.gz
aws-syslog1-tts.nga.gov / nga-splunk-syslog-1 salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/* |sort -h' #Old Logs salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/* |sort -h' salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/fortigate/* |sort -h' salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/fortigate///* |sort -h' salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/fortigate/aws-syslog1-tts.nga.gov/log/' --out=txt salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/netscaler/// |sort -h' salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/netscaler/2020-01-10/' --out=txt #Current Logs salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/fortigate/ |sort -h' salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/fortigate/aws-syslog1-tts.nga.gov/log/* |sort -h' salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/fortigate/aws-syslog1-tts.nga.gov/log/2020-01-26/*' --out=txt
2 aws-syslog2-tts.nga.gov / nga-splunk-syslog-2 salt nga-splunk-syslog-2 cmd.run 'df -h' salt nga-splunk-syslog-2 cmd.run 'du -sh /opt/syslog-ng/* |sort -h' salt nga-splunk-syslog-2 cmd.run 'du -sh /opt/syslog-ng/old_logs/* |sort -h' salt nga-splunk-syslog-2 cmd.run 'du -sh /opt/syslog-ng/old_logs/fortigate/* |sort -h' salt nga-splunk-syslog-2 cmd.run 'rm -rf /opt/syslog-ng/old_logs/fortigate/2020-01-10/' --out=txt salt nga-splunk-syslog-2 cmd.run 'du -sh /opt/syslog-ng/fortigate/aws-syslog2-tts.nga.gov/log/ |sort -h' salt nga-splunk-syslog-2 cmd.run 'rm -rf /opt/syslog-ng/fortigate/aws-syslog2-tts.nga.gov/log/2020-03-01/*' --out=txt
nga-splunk-indexer-1.msoc.defpoint.local salt nga-splunk-indexer-1.msoc.defpoint.local cmd.run 'rm -rf /var/log/hubble' salt nga-splunk-indexer-1.msoc.defpoint.local cmd.run 'du -sh /var/log/* |sort -h'
afssplhf103.us.accenturefederal.com afs-splunk-syslog-1 salt afs-splunk-syslog-1* cmd.run 'df -h' salt afs-splunk-syslog-1* cmd.run 'du -sh /opt/syslog-ng/* |sort -h' salt afs-splunk-syslog-1* cmd.run 'du -sh /opt/syslog-ng/old_logs/* |sort -h' salt afs-splunk-syslog-1* cmd.run 'du -sh /opt/syslog-ng/old_logs/junos/* |sort -h' salt afs-splunk-syslog-1* cmd.run 'du -sh /opt/syslog-ng/old_logs/cisco_asa/* |sort -h' salt afs-splunk-syslog-1* cmd.run 'du -sh /opt/syslog-ng/old_logs/mcas/* |sort -h' salt afs-splunk-syslog-1* cmd.run 'rm -rf /opt/syslog-ng/old_logs/junos/2020-11-02/' --out=txt salt afs-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/cisco_asa/2020-01-08/' --out=txt salt afs-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/mcas/2020-01-27/' --out=txt salt afs-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/junos/afssplhf103.us.accenturefederal.com/log/* |sort -h' salt afs-splunk-syslog-1* cmd.run 'rm -rf /opt/syslog-ng/junos/afssplhf103.us.accenturefederal.com/log/2020-01-29/*' --out=txt