NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
System volume root's usage is 90% RN102
Please can someone help, I am a total novice with these things. I have read some of the post about the same issue, it talks of SSH mumbo jumbo...lol. I have switched SSH on in the admin GUI so should be good to go if someone can guide me. I have switched antivirus off as its been suggested on other posts that this could be the problem. latest firmware was installed a couple of weeks ago (possibly when the problem started) no apps installed. every thing has been good up until now, I just use it as a basic nas for home network.
Be careful here, as there are support implications in trying to fix this yourself. Typing the wrong thing can do damage, and require you to do a factory default to recover. So I recommend backing up the NAS first. https://kb.netgear.com/30068/ReadyNAS-OS-6-SSH-access-support-and-configuration-guides
You first disable the AntiVirus service - which it sounds like you have already done.
The second step is to enable SSH in the NAS web ui in system->settings. If your password is still set to password, you also need to change it to something else.
Now you need a program to connect to the NAS using SSH. Windows 10 has a program built in (called ssh). So do Macs (terminal). For other windows versions you need to install putty from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (and you can also use putty on Windows 10 if you like).
Then you use that program to connect to the NAS:
- ssh root@nas-ip-address on Windows 10 (entered on the Windows 10 search bar)
- launch terminal, enter ssh root@nas-ip-address on the mac
- launch putty, make sure ssh is selected as the connection type. Enter the nas-ip-address and click open. Enter root as the username.
Use the real NAS IP address of course. It's important to log in as root. Don't log in as admin. When you see the password prompt, enter the NAS admin password (root and admin use the same password).
If you have trouble launching one of these programs, then you can post back (or just google for more info).
Be careful on the typing of the commands below. Be sure to use the correct slash direction, etc.
After you are logged in, you enter
cd /var/lib/clamav ls -lsh
You should now see a folder listing, with some folders that look like clamav-<very long string>.tmp
If you don't see these tmp folders, then post back and tell us what you do see.
If you do see these tmp folders, then you remove them by entering
rm -r clamav-*.tmp ls -lsh
You should now see a second folder listing, and those tmp folders should be gone.
asimb has posted a screen shot illustrating these commands: https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/System-volume-root-s-usage-is-xx-This-condition-should-not-occur/m-p/1722860#M178464
I'm taking the liberty of re-posting that screen shot here.
I recommend leaving the AntiVirus service off - at least for now.
71 Replies
Replies have been turned off for this discussion
Just checked my log
Jan 28, 2019 06:53:50 PM
System: Firmware was upgraded to 6.9.5.Be careful here, as there are support implications in trying to fix this yourself. Typing the wrong thing can do damage, and require you to do a factory default to recover. So I recommend backing up the NAS first. https://kb.netgear.com/30068/ReadyNAS-OS-6-SSH-access-support-and-configuration-guides
You first disable the AntiVirus service - which it sounds like you have already done.
The second step is to enable SSH in the NAS web ui in system->settings. If your password is still set to password, you also need to change it to something else.
Now you need a program to connect to the NAS using SSH. Windows 10 has a program built in (called ssh). So do Macs (terminal). For other windows versions you need to install putty from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (and you can also use putty on Windows 10 if you like).
Then you use that program to connect to the NAS:
- ssh root@nas-ip-address on Windows 10 (entered on the Windows 10 search bar)
- launch terminal, enter ssh root@nas-ip-address on the mac
- launch putty, make sure ssh is selected as the connection type. Enter the nas-ip-address and click open. Enter root as the username.
Use the real NAS IP address of course. It's important to log in as root. Don't log in as admin. When you see the password prompt, enter the NAS admin password (root and admin use the same password).
If you have trouble launching one of these programs, then you can post back (or just google for more info).
Be careful on the typing of the commands below. Be sure to use the correct slash direction, etc.
After you are logged in, you enter
cd /var/lib/clamav ls -lsh
You should now see a folder listing, with some folders that look like clamav-<very long string>.tmp
If you don't see these tmp folders, then post back and tell us what you do see.
If you do see these tmp folders, then you remove them by entering
rm -r clamav-*.tmp ls -lsh
You should now see a second folder listing, and those tmp folders should be gone.
asimb has posted a screen shot illustrating these commands: https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/System-volume-root-s-usage-is-xx-This-condition-should-not-occur/m-p/1722860#M178464
I'm taking the liberty of re-posting that screen shot here.
I recommend leaving the AntiVirus service off - at least for now.
Thanks, this helped and the files are gone.
Hopefully message stays out.
When / How will we be informed that antivirus can be switched on again?
Regards
Jos
Great Topic started getting the same errors a couple days ago.
RN104 with 4 x 4TB WD Red on 6.9.5.
I found the same issue, clamav folder was filling up. I noticed a couple weeks ago that the AV indicator in the web gui had turned yellow, and a few days ago received the "System volume root's usage is 82%. This Should not occur under normal conditions. Contact Technical Support" message from my NAS RN104, this has been working perfectly since new.
root@ReadyNAS:/var/lib# du -d1 -h 40K ./connman 4.0K ./snmp 4.0K ./dbus 8.0K ./mdadm 4.0K ./nut 12K ./apache2 30M ./mysql 4.0K ./insserv 120K ./ucf 4.0K ./libuuid 2.6G ./clamav 32K ./php5 13M ./dpkg 2.6M ./samba 72M ./apt 4.0K ./update-rc.d 8.0K ./vim 4.0K ./replisync 28K ./pam 4.0K ./misc 8.0K ./sudo 136K ./systemd 4.0K ./urandom 16K ./nfs 4.0K ./initscripts 2.7G . root@ReadyNAS:/var/lib# cd /var/lib/clamav/ root@ReadyNAS:/var/lib/clamav# ls -lhS total 276M -rw-r--r-- 1 root root 162M Mar 6 04:14 daily.cld -rw-r--r-- 1 root root 113M Oct 9 2017 main.cvd -rw-r--r-- 1 root root 990K Jan 2 17:21 bytecode.cld drwxr-xr-x 3 root root 4.0K Mar 12 04:18 clamav-1052674f670d6fa214f5d8723b001e10.tmp drwxr-xr-x 3 root root 4.0K Mar 17 13:22 clamav-12c4946d6d4083884efc403bb8b31b15.tmp drwxr-xr-x 3 root root 4.0K Mar 19 13:23 clamav-30c842f8c25ec16062fb0b6ab310b83d.tmp drwxr-xr-x 3 root root 4.0K Mar 11 04:17 clamav-381bb4ee2680af85d7b6a0312043aff8.tmp drwxr-xr-x 3 root root 4.0K Mar 7 04:14 clamav-3b65e5839c926ce2d5b94f6533d2a416.tmp drwxr-xr-x 3 root root 4.0K Mar 9 04:15 clamav-4bf40655f003ddd7324deceb0e68f929.tmp drwxr-xr-x 3 root root 4.0K Mar 12 13:26 clamav-60161bf85190b4b62e96e7c28aa0d5fd.tmp drwxr-xr-x 3 root root 4.0K Mar 8 04:15 clamav-622892ca4baa94df9e6b4c5e6635ecea.tmp drwxr-xr-x 3 root root 4.0K Mar 13 13:27 clamav-6b4e0c8587bdc08fee089fb74b67c604.tmp drwxr-xr-x 3 root root 4.0K Mar 18 13:22 clamav-8f9e7433684605db15a69dd76769f85b.tmp drwxr-xr-x 3 root root 4.0K Mar 15 13:21 clamav-9dc4d920abae9ed1649e0370c8e823cd.tmp drwxr-xr-x 3 root root 4.0K Mar 14 13:21 clamav-a5c4514b24634f7e4ea9fbbfd20cda1e.tmp drwxr-xr-x 3 root root 4.0K Mar 10 04:16 clamav-df569d3b49c09f275d74b7fd9e44b9a8.tmp drwxr-xr-x 3 root root 4.0K Mar 16 13:22 clamav-f8970b2254f8259e1a5d0e67140b8466.tmp -rw------- 1 root root 1.4K Mar 19 13:23 mirrors.dat -rw-r--r-- 1 root root 48 Mar 6 04:16 antivir.ini root@ReadyNAS:/var/lib/clamav# du -d1 -h 166M ./clamav-df569d3b49c09f275d74b7fd9e44b9a8.tmp 166M ./clamav-12c4946d6d4083884efc403bb8b31b15.tmp 166M ./clamav-4bf40655f003ddd7324deceb0e68f929.tmp 166M ./clamav-3b65e5839c926ce2d5b94f6533d2a416.tmp 166M ./clamav-f8970b2254f8259e1a5d0e67140b8466.tmp 166M ./clamav-622892ca4baa94df9e6b4c5e6635ecea.tmp 166M ./clamav-9dc4d920abae9ed1649e0370c8e823cd.tmp 166M ./clamav-381bb4ee2680af85d7b6a0312043aff8.tmp 166M ./clamav-30c842f8c25ec16062fb0b6ab310b83d.tmp 166M ./clamav-6b4e0c8587bdc08fee089fb74b67c604.tmp 166M ./clamav-1052674f670d6fa214f5d8723b001e10.tmp 166M ./clamav-60161bf85190b4b62e96e7c28aa0d5fd.tmp 166M ./clamav-8f9e7433684605db15a69dd76769f85b.tmp 166M ./clamav-a5c4514b24634f7e4ea9fbbfd20cda1e.tmp 2.6G . root@ReadyNAS:/var/lib/clamav# rm -r clamav-*.tmp root@ReadyNAS:/var/lib/clamav# ls -lhS total 276M -rw-r--r-- 1 root root 162M Mar 6 04:14 daily.cld -rw-r--r-- 1 root root 113M Oct 9 2017 main.cvd -rw-r--r-- 1 root root 990K Jan 2 17:21 bytecode.cld -rw------- 1 root root 1.4K Mar 19 13:23 mirrors.dat -rw-r--r-- 1 root root 48 Mar 6 04:16 antivir.ini root@ReadyNAS:/var/lib/clamav# cd / root@ReadyNAS:/# du -d1 -h 4.0K ./dev 365M ./usr 16M ./opt 11M ./etc 620M ./var 21M ./apps 30M ./frontview 4.0K ./boot 0 ./sys 28M ./run 32K ./media 28M ./lib 4.0K ./srv 52K ./root 0 ./proc 16K ./lost+found 10M ./sbin 6.0M ./bin 27M ./home 28K ./tmp 1.6T ./data 4.0K ./selinux 1.6T . root@ReadyNAS:/#
So Looks like we need an update sharpish I have now disabled the AV although it still seems to be trying to update as the filesystem grew again overnight. so i will now remove the .tmp files as the 14 .tmp files are eating 2.3G on their own.
but thanks to this thread I'm working correctly although with clamav disabled. and now i know what to do to if the directory grows again.
I had the same issue. I upgraded the firmware on 5 Mar 19 and then on 20 Mar started getting the messages about the root volume. I've followed the above and it seems to now be resolved. Thanks.
Thanks guys, good explanation. Worked for me.
Regards
Peter
you can find a brief instruction how to do here https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/System-volume-root-s-usage-is-xx-Th... message 3, 7 and 10 (especially jpg-attachment).
Thanks for the quick reply, I think I have got my head round this, one problem....when I try to run SSH command prompt (which I find by searching in the bottom left search box) it only shows up briefly on my screen and disappears...any ideas why this is?
Thanks
Ok i managed to find a way of getting command prompt ssh enabled using youtube.
next problem is I get to this line
root@192.168.0.11's password:
and it wont accept any key presses from the keyboard..
ahhhhh
any suggestions guys?
Thanks
Successfully completed diagnostics
System
- Volume root is 100.00% full
- /var is consuming 3288 MB
Logs
- No errors found.
How to fix the error? Everything is slowly working!
dasgweg wrote:
Successfully completed diagnostics
System
- Volume root is 100.00% full
- /var is consuming 3288 MB
Logs
- No errors found.
How to fix the error? Everything is slowly working!I am from Russia, I don’t understand English at all! Especially your terms. It is possible for all guys who have the same problem, and they are common, to record a video with the instructions! ?? I personally can not understand anything at all, according to your instructions. I would be very grateful if this is possible. If I perform this operation, will I lose the data on the disk? thank
Dear StephenB
I got the same issue on my RN214 about couple days ago, log shows;
Nov 07, 2023 08:00:30 Volume: System volume root's usage is 86%. This condition should not occur under normal conditions. Contact technical support. I disabled AV and ssh to clean tmp files but it doesn't have these files and /var/log itself taking too much space, could you help?
root@UniNAS214:~# mount --bind / /mnt
root@UniNAS214:~# cd /mnt
root@UniNAS214:/mnt# du -d1 -h
4.0K ./sys
4.0K ./boot
12K ./dev
112K ./tmp
31M ./frontview
4.0K ./mnt
231M ./usr
4.0K ./data
8.8M ./etc
4.0K ./proc
16K ./lost+found
4.0K ./run
1.8G ./var
301M ./root
4.0K ./media
11M ./sbin
29M ./lib
798M ./opt
4.0K ./apps
4.0K ./home
4.0K ./srv
6.0M ./bin
3.2G .
root@UniNAS214:/mnt# cd /var
root@UniNAS214:/var# du -d1 -h
78M ./cores
159M ./cache
4.0K ./tmp
8.0K ./www
4.0K ./mail
94M ./backups
16K ./netatalk
1.1G ./log
4.0K ./local
9.5M ./readynasd
445M ./lib
4.0K ./opt
16K ./spool
4.0K ./ftp
1.8G .
root@UniNAS214:/var#
root@UniNAS214:~# cd /var/log
root@UniNAS214:/var/log# du -d1 -h
44K ./apt
76K ./frontview
57M ./journal
4.0K ./fsck
288K ./readynasd
973M ./apache2
648K ./samba
1.1G .
root@UniNAS214:/var/log# ls /mnt/var/log -alhS
total 200K
-rw-r--r-- 1 root root 286K Nov 7 18:39 lastlog
-rw-rw-r-- 1 root utmp 82K Nov 7 18:39 wtmp
-rw-r--r-- 1 root root 27K Nov 5 18:20 dpkg.log
-rw-r--r-- 1 root root 24K Nov 6 06:37 faillog
-rw-r----- 1 root root 8.1K Nov 5 19:09 proftpd.log
-rw------- 1 root root 6.2K Nov 7 19:55 tallylog
-rw------- 1 root utmp 4.2K Nov 5 16:17 btmp
drwxr-xr-x 9 root root 4.0K Sep 5 2022 .
drwxr-xr-x 16 root root 4.0K Jul 30 14:59 ..
drwxr-x--- 2 root adm 4.0K Aug 25 2018 apache2
drwxr-xr-x 2 root root 4.0K Aug 22 2022 apt
drwxr-xr-x 3 root root 4.0K Dec 11 2012 frontview
drwxr-xr-x 2 root root 4.0K Apr 30 2016 fsck
drwxr-sr-x+ 3 root systemd-journal 4.0K Feb 17 2023 journal
drwxr-xr-x 2 admin admin 4.0K Feb 19 2023 readynasd
drwxr-xr-x 2 root root 4.0K Oct 28 21:09 samba
root@UniNAS214:/var/log#
Here's what I see on my RN202:
root@RN202:/mnt# du -d1 -h 6.0M ./bin 4.0K ./proc 4.0K ./boot 11M ./sbin 24K ./tmp 16K ./lost+found 4.0K ./run 31M ./frontview 4.0K ./sys 12K ./dev 8.9M ./etc 4.0K ./media 3.9M ./opt 4.0K ./apps 4.0K ./mnt 4.0K ./data 4.0K ./home 217M ./usr 29M ./lib 325M ./var 4.0K ./Data-2 40K ./root 4.0K ./srvBiggest differences appear to be in /opt and /var/log
root@RN202:/mnt/opt# du -d1 -h 2.2M ./readycloud 740K ./p2p 204K ./xcloud 24K ./remote 748K ./replication 3.9Mroot@RN202:/mnt/var/log# du -d1 -h 53M ./journal 480K ./readynasd 3.3M ./frontview 4.0K ./fsck 260K ./samba 4.0K ./apache2 24K ./apt 57M .On /opt, you might want to provide some more details on what is in there.
On /var/log - it all appears to be apache 2 logging. Did you try clearing the logs from the NAS web UI? If you have, then what are you seeing in /var/log/apache2? (it's hard to read your info on that).
I've suddenly started getting similar messages to others mentioned in this series of posts. Unfortunately I'm completely ignorant when it comes to Unix commands so I really don't know what to do - I have followed the earlier instructions but now I'm stuck. Antivirus has been switched off on my NAS 102 (running 6.10.2) for some time, possibly over a year. The only app on the device is Resilio Sync and that has never been used.
The log for today shows the following messages:-
31 Dec 2023 12:30:04 System: Service protocol SSH is enabled. 31 Dec 2023 08:00:14 Volume: System volume root's usage is 84%. This condition should not occur under normal conditions. Contact technical support. 31 Dec 2023 00:35:47 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN Videos. 31 Dec 2023 00:35:36 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN readydrop. 31 Dec 2023 00:35:34 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN Pictures. 31 Dec 2023 00:35:31 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN Music. 31 Dec 2023 00:35:29 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN JillsEdge. 31 Dec 2023 00:35:22 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN HOME-XPS-Documents. 31 Dec 2023 00:35:18 Snapshot: Snapshot prune worker successfully deleted snapshot 2023_12_03__00_00_00 from share or LUN Documents. 31 Dec 2023 00:00:38 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN Videos. 31 Dec 2023 00:00:37 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN readydrop. 31 Dec 2023 00:00:35 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN Pictures. 31 Dec 2023 00:00:33 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN Music. 31 Dec 2023 00:00:31 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN JillsEdge. 31 Dec 2023 00:00:27 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN HOME-XPS-Documents. 31 Dec 2023 00:00:26 Snapshot: Snapshot c_1703980822 was successfully created for share or LUN Documents. I've enabled SSH and run the SSH command and entered a few of the commands mentioned in earlier posts - the results are above. The log messages says the ROOT directory is 84% full (and climbing by 1% every 2 or 3 days) - the df command seems to say a directory (md0 ?) is 89% full, but I'm not sure these are talking about the same thing - probably not.
Please can someone shed some light on what is happening with this system and what I should do to resolve what looks like a serious problem looming?
Bernard
Bernard46 wrote:
The log for today shows the following messages:-
The log messages says the ROOT directory is 84% full (and climbing by 1% every 2 or 3 days) - the df command seems to say a directory (md0 ?) is 89% full, but I'm not sure these are talking about the same thing - probably not.Actually it is the same. md0 is the RAID array (virtual disk) for the OS partition (e.g., the root).
Bernard46 wrote:
Please can someone shed some light on what is happening with this system and what I should do to resolve what looks like a serious problem looming?
It'd be prudent to back up the data on the NAS right away. A full root can result in a bricked NAS or damaged configuration files.
Once that is done, you have the option to do a factory default (which reformat the disks and does a clean install). Then reconfigure the NAS and restore the files from backup. That would completely resolve the issue.
The other option is to try to find the file(s) that are causing the problem, and then delete them. That can take some time, and of course you do have to be cautious when deleting things.
If you want to look more closely, the best starting point is to remount the root as /mnt. The reason is that there are other mount points on the root that appear to be part of the root partition, but really are folders on the data volume. Exploring /mnt eliminates that problem. This command will do that:
mount --bind / /mntThen enter
du -csh /mnt/*That will give you the data stored in each in each subfolder, and give you a clue where the space is going.
You should see space usage similar to this:
root@RN102:~# mount --bind / /mnt root@RN102:~# du -csh /mnt/* 4.0K /mnt/apps 5.7M /mnt/bin 4.0K /mnt/boot 4.0K /mnt/data 12K /mnt/dev 9.4M /mnt/etc 31M /mnt/frontview 0 /mnt/ftp_ban.tbl 4.0K /mnt/home 0 /mnt/homes 30M /mnt/lib 16K /mnt/lost+found 56K /mnt/media 4.0K /mnt/mnt 16M /mnt/opt 4.0K /mnt/proc 36K /mnt/root 4.0K /mnt/run 11M /mnt/sbin 12K /mnt/share_lun_ui_fix.sh 4.0K /mnt/srv 4.0K /mnt/sys 24K /mnt/tmp 269M /mnt/usr 446M /mnt/var 815M total root@RN102:~#Likely you'll see a folder on your NAS that has a lot more space than these. You can then explore that further by adding the folder to the command. For instance, this will look deeper into var:
root@RN102:~# du -csh /mnt/var/* 102M /mnt/var/backups 85M /mnt/var/cache 4.0K /mnt/var/cores 4.0K /mnt/var/ftp 260M /mnt/var/lib 4.0K /mnt/var/local 0 /mnt/var/lock 60M /mnt/var/log 4.0K /mnt/var/mail 16K /mnt/var/netatalk 4.0K /mnt/var/opt 13M /mnt/var/readynasd 0 /mnt/var/run 16K /mnt/var/spool 4.0K /mnt/var/tmp 8.0K /mnt/var/www 518M total root@RN102:~#Once you find the problem folder(s), you can list them with ls, and then post the details here. Then we can give you some further advice on what to do.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
