NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
System volume root's usage is 90% RN102
Please can someone help, I am a total novice with these things. I have read some of the post about the same issue, it talks of SSH mumbo jumbo...lol. I have switched SSH on in the admin GUI so shoul...
Be careful here, as there are support implications in trying to fix this yourself. Typing the wrong thing can do damage, and require you to do a factory default to recover. So I recommend backing up the NAS first. https://kb.netgear.com/30068/ReadyNAS-OS-6-SSH-access-support-and-configuration-guides
You first disable the AntiVirus service - which it sounds like you have already done.
The second step is to enable SSH in the NAS web ui in system->settings. If your password is still set to password, you also need to change it to something else.
Now you need a program to connect to the NAS using SSH. Windows 10 has a program built in (called ssh). So do Macs (terminal). For other windows versions you need to install putty from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (and you can also use putty on Windows 10 if you like).
Then you use that program to connect to the NAS:
- ssh root@nas-ip-address on Windows 10 (entered on the Windows 10 search bar)
- launch terminal, enter ssh root@nas-ip-address on the mac
- launch putty, make sure ssh is selected as the connection type. Enter the nas-ip-address and click open. Enter root as the username.
Use the real NAS IP address of course. It's important to log in as root. Don't log in as admin. When you see the password prompt, enter the NAS admin password (root and admin use the same password).
If you have trouble launching one of these programs, then you can post back (or just google for more info).
Be careful on the typing of the commands below. Be sure to use the correct slash direction, etc.
After you are logged in, you enter
cd /var/lib/clamav ls -lsh
You should now see a folder listing, with some folders that look like clamav-<very long string>.tmp
If you don't see these tmp folders, then post back and tell us what you do see.
If you do see these tmp folders, then you remove them by entering
rm -r clamav-*.tmp ls -lsh
You should now see a second folder listing, and those tmp folders should be gone.
asimb has posted a screen shot illustrating these commands: https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/System-volume-root-s-usage-is-xx-This-condition-should-not-occur/m-p/1722860#M178464
I'm taking the liberty of re-posting that screen shot here.
I recommend leaving the AntiVirus service off - at least for now.
what command do I use to see what is in it?
i'm learning a lott!
root@ReadyNas:/mnt/var/log# du -d1 -h
1.6M ./samba
4.0K ./fsck
4.0K ./mysql
1.5M ./apache2
74M ./squeezeboxserver
4.0K ./news
71M ./journal
448K ./freeradius
14M ./frontview
228K ./apt
2.4M ./readynasd
2.1G .
root@ReadyNas:/mnt/var/log# cd /mnt
root@ReadyNas:/mnt# cd */squeezeboxserver
root@NasJan:/mnt/etc/squeezeboxserver# du -d1 -h
32K .
Janess wrote:
root@ReadyNas:/mnt/var/log# du -d1 -h
1.6M ./samba
4.0K ./fsck
4.0K ./mysql
1.5M ./apache2
74M ./squeezeboxserver
4.0K ./news
71M ./journal
448K ./freeradius
14M ./frontview
228K ./apt
2.4M ./readynasd
2.1G .The directories add up to about 165MB - not anywhere close to 2.1G. So there must be some big files in /mnt/var/log itself. Can you post
# ls /mnt/var/log -alhS
The S option will sort so the biggest files will be at the top.
Hello Stephen, It look syslog is the greatest.
-rw-r----- 1 root adm 1.9G May 21 16:45 syslog
-rw-r----- 1 root adm 18M May 21 16:41 messages
-rw-r----- 1 root adm 6.4M May 21 16:45 daemon.log
-rw-r----- 1 root adm 2.0M May 21 15:26 debug
-rw-rw-r-- 1 root utmp 1.9M May 21 16:29 wtmp
-rw-r--r-- 1 root root 1.1M Mar 22 20:53 kern.log.old
-rw-r--r-- 1 root root 996K May 21 15:40 daemon.log.old
-rw-r--r-- 1 root root 934K Apr 19 12:17 user.log.old
-rw-r--r-- 1 root root 907K Aug 17 2018 auth.log.old
-rw-r----- 1 root adm 701K May 21 16:39 auth.log
-rw-r----- 1 root adm 698K May 21 15:27 kern.log
-rw-r----- 1 root adm 549K May 21 16:41 user.log
-rw-r--r-- 1 root root 525K May 7 16:54 dpkg.log
-rw-r--r-- 1 root root 426K Dec 3 2016 ctscand.log.old
-rw-r--r-- 1 root root 405K Sep 22 2014 netatalk.log
-rw-r----- 1 root root 16K Sep 23 2014 proftpd.log
-rw-r--r-- 1 root root 8.2K Feb 5 16:35 alternatives.log
drwxr-xr-x 13 root root 4.0K Dec 21 03:53 .drwxr-xr-x 17 root root 4.0K May 7 02:25 ..
drwxr-xr-x 2 root root 4.0K Dec 11 2012 apache2
Hello Stephen, It look syslog is the greatest.
-rw-r----- 1 root adm 1.9G May 21 16:45 syslog
-rw-r----- 1 root adm 18M May 21 16:41 messages
-rw-r----- 1 root adm 6.4M May 21 16:45 daemon.log
-rw-r----- 1 root adm 2.0M May 21 15:26 debug
-rw-rw-r-- 1 root utmp 1.9M May 21 16:29 wtmp
-rw-r--r-- 1 root root 1.1M Mar 22 20:53 kern.log.old
-rw-r--r-- 1 root root 996K May 21 15:40 daemon.log.old
-rw-r--r-- 1 root root 934K Apr 19 12:17 user.log.old
-rw-r--r-- 1 root root 907K Aug 17 2018 auth.log.old
-rw-r----- 1 root adm 701K May 21 16:39 auth.log
-rw-r----- 1 root adm 698K May 21 15:27 kern.log
-rw-r----- 1 root adm 549K May 21 16:41 user.log
-rw-r--r-- 1 root root 525K May 7 16:54 dpkg.log
-rw-r--r-- 1 root root 426K Dec 3 2016 ctscand.log.old
-rw-r--r-- 1 root root 405K Sep 22 2014 netatalk.log
-rw-r----- 1 root root 16K Sep 23 2014 proftpd.log
-rw-r--r-- 1 root root 8.2K Feb 5 16:35 alternatives.log
drwxr-xr-x 13 root root 4.0K Dec 21 03:53 .drwxr-xr-x 17 root root 4.0K May 7 02:25 ..
drwxr-xr-x 2 root root 4.0K Dec 11 2012 apache2
etc
Janess wrote:
Hello Stephen, It look syslog is the greatest.
-rw-r----- 1 root adm 1.9G May 21 16:45 syslog
And it shouldn't be there at all (it's not something a "stock" readynas would create). What apps do you have installed?
There are some others that aren't on my NAS - I've marked them in red below. The rest are all small though.
-rw-r----- 1 root adm 1.9G May 21 16:45 syslog -rw-r----- 1 root adm 18M May 21 16:41 messages -rw-r----- 1 root adm 6.4M May 21 16:45 daemon.log -rw-r----- 1 root adm 2.0M May 21 15:26 debug -rw-rw-r-- 1 root utmp 1.9M May 21 16:29 wtmp -rw-r--r-- 1 root root 1.1M Mar 22 20:53 kern.log.old -rw-r--r-- 1 root root 996K May 21 15:40 daemon.log.old -rw-r--r-- 1 root root 934K Apr 19 12:17 user.log.old -rw-r--r-- 1 root root 907K Aug 17 2018 auth.log.old -rw-r----- 1 root adm 701K May 21 16:39 auth.log -rw-r----- 1 root adm 698K May 21 15:27 kern.log -rw-r----- 1 root adm 549K May 21 16:41 user.log -rw-r--r-- 1 root root 525K May 7 16:54 dpkg.log -rw-r--r-- 1 root root 426K Dec 3 2016 ctscand.log.old -rw-r--r-- 1 root root 405K Sep 22 2014 netatalk.log -rw-r----- 1 root root 16K Sep 23 2014 proftpd.log -rw-r--r-- 1 root root 8.2K Feb 5 16:35 alternatives.log
You can recover the 1.9G of space by entering this
# echo > syslog
That will truncate syslog (bringing it down to 0 bytes). Though you still should uninstall the app that is creating it.
Even after this truncation, you still have a root partition that is about 50% full. Normally it's in the 25-30% range. We could look further, though getting down to 50% should make things safe for now.
BTW, when you are finished with /mnt, you unmount it by
# cd // # umount /mnt
The cd is because the umount will fail if you are in the /mnt folder/ Note the spelling "umount". It's easy to type "unmount".
It's basically the same process of sorting out where the space is going.
My top level looks like
6.4M ./bin 0 ./boot 24K ./dev 11M ./etc 0 ./home 33M ./lib 4.0K ./lib64 0 ./media 7.2M ./opt 0 ./proc 28K ./root 0 ./run 11M ./sbin 0 ./srv 0 ./sys 0 ./tmp 233M ./usr 615M ./var 0 ./mnt 0 ./data 0 ./apps 43M ./frontview 959M .
So both /usr and /var are quite a bit smaller than what you see.
root@NAS:/mnt/var# du -d1 -h 0 ./opt 93M ./backups 0 ./local 59M ./log 4.0K ./spool 0 ./mail 50M ./cache 386M ./lib 0 ./tmp 4.0K ./www 8.0K ./netatalk 17M ./cores 0 ./ftp 14M ./readynasd 615M .
root@NAS:/mnt/usr# du -d1 -h 4.0K ./local 26M ./sbin 0 ./src 40M ./share 34M ./bin 0 ./games 8.0K ./include 135M ./lib 233M .
There will be differences between systems - depending on apps (basically none in my case) and other configuration. 50% might well be ok for what you have running. For some years my Pro-6 was running at 50% (due to my installation of CrashPlan).
Janess wrote:
I did DESTROY severall apps through the adm menu.
You mean you uninstalled them? What apps are still running?
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
