RR2304 - System volume root is 91%.

[ThomasNanninga]

4x2TB NAS with current OS 6.10.2 reports the same warning message on 91% usage as many other users were facing already. According to the info here I have

- turned on SSH Service

- turned off AntiVirus

- logged on with Windows 10 SSH client and changed into directory /var/lib/clamav#

My questions:

1. It shows 267 MB usage and that makes the 91% usage. What files do I have to delete?

2. If I mess up the system I need to restart with factory defaults. Does it mean my setting are gone or do I loose all data on the NAS?

Doing a backup is easy spoken but 4 TB not just into the pocket.

[ThomasNanninga · Accepted solution]

Finally I could free the OS partition, no more warning messages, thanks for all the help.

I add a small summary of my steps for others that may have a similar problem.

1. Preparations in NAS settings

a. Activate SSH Service with password: System > Settings > Services

b. Turn off AntiVirus 

2. SSH login (Windows 10)

ssh root@<nas-ip-address>

Password: NAS Admin password

3. File search

a. Search for any large files >200MB: find /var -type f -size +200M

b. Look into Antivitus definition directory for any temp files: cd /var/lib/clamav

ls -lsh

c. Look into media/USB_HDD_1 (that is my 8TB USB connected HD) folders for any files 

Result 3a-c: no large files, no temps, nothing peculiar in USB_...

Some threads can be found here where users had to delete the /clamav tmp files, not in this case.

4. Mount the root partition as mnt to eliminate directories from listing that actually point to the data partition 

a. mount --bind / /mnt

b. ls -lsh -> found many chunk-0000x files in the root directory (StephenB telling that this is from PLEX transcoding)

c. Delete files: rm /chunk-00*

Another ls -lsh: all chunk deleted and reduced partition usage from 3,5G to 1G 

d. cd //

unmount /mnt

e. Turn on AntiVirus in NAS settings

[Retired_Member]

You can search large file in root OS partition,the command as below:

find /var -type f -size +500M

[StephenB]

---

@ThomasNanninga wrote:

1. It shows 267 MB usage and that makes the 91% usage. What files do I have to delete?

---

FWIW, you've found that your problem isn't caused by the ClamAV antivirus service.  It's caused by something else.  @Retired_Member's command should help you find the file(s) that are causing the problem.

Alternatively you could use paid support at my.netgear.com.

---

@ThomasNanninga wrote:

Doing a backup is easy spoken but 4 TB not just into the pocket.

---

A 4 TB USB drive costs about $100 in the US.  Per-incident support from Netgear is about the same cost.  And if you ever need data recovery (and w/o backup you eventually will), you'd be spending $300 or more (recovery software + the drive to put the recovered data on).  More importantly, there's a good chance you won't get your data back.  I get the need to manage expenses, but IMO not investing in backup is false economy.  So maybe think a bit about what data loss would mean, and what your data is worth to you.

---

@ThomasNanninga wrote:

2. If I mess up the system I need to restart with factory defaults. Does it mean my setting are gone or do I loose all data on the NAS?

---

You'll have to rebuild the NAS from scratch - so all your settings and data will be gone.

[ThomasNanninga]

@stephen, thanks for clarification. Fully agree, 100 bucks is nothing compared to loss of data. 

I think I got the directory that sucks. I'm transferring surveillance pics and 100M mpgs via ftp and seems that they remain in /var/ftp that has now 266Giga. I think deleting all subfolders will solve the problem but better wait for the USB disk.

I haven't seen any setting in FTP protocol regarding directory or file deletion.

 

[StephenB]

---

@ThomasNanninga wrote:

/var/ftp that has now 266Giga. I think deleting all subfolders will solve the problem but better wait for the USB disk.

---

Be careful here.  /var/ftp is actually a linux mount point.  The on-disk space you are seeing here is really on the data volume (/var/ftp mounts the shares that have ftp enabled for the FTP server).  It's not the cause of your full OS partition (which is only 4 GB in size btw).

Try remounting the OS partition as /mnt - that will take the mount points out of the equation and make the OS partition easier to search.

# mount --bind / /mnt

Sometimes files end up "underneath" mount points - particularly if you use USB backup jobs.  So after doing the mount, look in /mnt/media first and make sure all the folders in there (USB_HDD_1, etc) are empty.

When done, you unmount with 

# cd //
# umount /mnt

The umount won't work if you are in the /mnt folder (what's why the cd // command is there).

[ThomasNanninga]

Ok, create an alternate view on the root partition called mnt and search for files that maybe underneath the radar. I mean, 91% of 4GB can't just hide somewhere.

Let me wait for the USB drive this week and once the backup is done I will come back and report.

Most the other system usage stories here had an issue with the ClamAV that seems to be not the case here.

[ThomasNanninga]

---

@Retired_Member wrote:

You can search large file in root OS partition,the command as below:

find /var -type f -size +500M

---

Btw. that command doesn't find anything, only below 100M you get results.

[StephenB]

---

@ThomasNanninga wrote:

---

@Retired_Member wrote:

You can search large file in root OS partition,the command as below:

find /var -type f -size +500M

---

Btw. that command doesn't find anything, only below 100M you get results.

---

Of course it depends on what the underlying problem is.  Often it's one or two oversize files - in which case @Retired_Member's command is great.  In other cases, it's filled with a bunch of smaller files.  Did you look in /mnt/media at the USB folders (after using the mount command I posted earlier)?

[ThomasNanninga]

When trying to save on USB disk I had a system crash with subsequent Hardware replacement. That's why I didn't responde for a while. Thank Good I could recover all data except some movies. Alfer having the new system reallocated to Insight I got 87% volume usage. 

The main reason is my Plex application. Out of 1,87GB total I have 800 MB in /data/apps/plexmediaserver/medialibrary/Plex Media Server/Media and 300MB in ../Metadata.

I could delete the Media Library manually and rebuild it. If that ends in the same result, can't I just source this data out of the root file? Or is that path hard-coded in Plex?

[StephenB]

---

@ThomasNanninga wrote:

can't I just source this data out of the root file? 

---

If you mean put it in the OS partition, then that would be a very bad idea.  

---

@ThomasNanninga wrote:

The main reason is my Plex application. Out of 1,87GB total I have 800 MB in /data/apps/plexmediaserver/medialibrary/Plex Media Server/Media and 300MB in ../Metadata.

---

/data is the data volume - so something is wrong with your units.  Did you mean 1.87 TB for the total size?  If so, why is ~1 GB concerning?

[ThomasNanninga]

Ok, I'm actually on the wrong path with that.

I did the mounting btw. as mnt, it shows me 3,5G, which is 87% of 4.

Changed into media trying to catch something "underneath"  but.... unsure

[ThomasNanninga]

I can see a lot of chunk-0000x files all from the same date.

[StephenB]

---

@ThomasNanninga wrote:

I can see a lot of chunk-0000x files all from the same date.

---

Those are generally from plex (aborted transcoding).  So just delete all of those.

[ThomasNanninga · Accepted solution]

Finally I could free the OS partition, no more warning messages, thanks for all the help.

I add a small summary of my steps for others that may have a similar problem.

1. Preparations in NAS settings

a. Activate SSH Service with password: System > Settings > Services

b. Turn off AntiVirus 

2. SSH login (Windows 10)

ssh root@<nas-ip-address>

Password: NAS Admin password

3. File search

a. Search for any large files >200MB: find /var -type f -size +200M

b. Look into Antivitus definition directory for any temp files: cd /var/lib/clamav

ls -lsh

c. Look into media/USB_HDD_1 (that is my 8TB USB connected HD) folders for any files 

Result 3a-c: no large files, no temps, nothing peculiar in USB_...

Some threads can be found here where users had to delete the /clamav tmp files, not in this case.

4. Mount the root partition as mnt to eliminate directories from listing that actually point to the data partition 

a. mount --bind / /mnt

b. ls -lsh -> found many chunk-0000x files in the root directory (StephenB telling that this is from PLEX transcoding)

c. Delete files: rm /chunk-00*

Another ls -lsh: all chunk deleted and reduced partition usage from 3,5G to 1G 

d. cd //

unmount /mnt

e. Turn on AntiVirus in NAS settings