> Source: [sk183836](https://support.checkpoint.com/results/sk/sk183836)

# sk183836 - The root partition on Security Management is increasing fast due to big log files

| Property | Value |
|----------|-------|
| Solution ID | sk183836 |
| Date Created | 2025-08-21 |
| Last Modified | 2026-06-02 |
| Technical Level | Advanced |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82, R82 |
| OS | Gaia |
| Platform | Open Server |

## Symptoms

- * Root partition is getting full.
* A few days after vacuuming the database (running the `vacuum_db` command on the Management Server), the root partition fills up again and lacks available disk space.
* Using find command to get the specific file:   
  `find /opt -type f -size +200000k -exec ls -lh {} \; 2>/dev/null | awk '{ print $9 ":" $5}' |grep -v tgz`   
  You get a similar response:  
  `/run/libpod/events/events.log: 18G`  
  `/var/lib/containers/storage/overlay-containers/9cc10f674ee106fcd16cc28c764baa59fb3bbb67a3e06b6fcb0550f7f3a6555a/userdata/ctr.log: 30G`

## Cause

The lack of permissions causes this error (the file can't be accessed properly due to `diff_report_server` restarting every second).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content