A short post on a topic that I recently experienced on vCenter Server Appliance, version 6.0.
After receiving an alert that the root “/” partition was quickly filling up, it is time to act quickly. When the root partition reaches 100% of it’s capacity, service disruption can occur.
First step is to check the capacity of the vCSA partitions. Log in to the vCSA through SSH, if you are running the appliance shell, enable and access the Bash shell:
Command> shell.set --enabled true Command> shell
In the Bash shell run this command to check the capacity of the partitions:
# df -h
The second line of the output (starting with /dev/sda3) shows the status of the root partition. If the value under Use% reaches 100%, you are in trouble. Also notice that the root partition is only 11 GB.
Second step is to determine the root cause of the full partition. A good strategy is to look for large consumers. The next command searches for files larger then 100 MB, only on the root partition:
# find / -xdev -type f -size +100M
In my case some interesting results:
/usr/lib/vmware-sca/wrapper/bin/wrapper.log /usr/lib/oracle/11.2/client64/lib/libociei.so /var/log/dnsmasq.log-20180121 /var/log/dnsmasq.log-20180128 /var/log/dnsmasq.log-20180107 /var/log/dnsmasq.log-20180114 /var/log/dnsmasq.log /etc/vmware-vpx/docRoot/client/Vmware-viclient.exe
The most eye-catching files are: the wrapper.log and the dnsmasq.log files.