> Source: [sk92907](https://support.checkpoint.com/results/sk/sk92907)

# sk92907 - Threat Emulation inspection failure due to disk space shortage

| Property | Value |
|----------|-------|
| Solution ID | sk92907 |
| Date Created | 2013-12-03 |
| Last Modified | 2023-05-07 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * SmartView Tracker / SmartView Monitor shows alerts about disk space (e.g., as described in [sk101149](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101149)).

* Files are neither sent for emulation, nor sent for Anti-Virus checks, even when free disk space is increased.

* Output of the '*df -h* ' command on the Threat Emulation Gateway shows less than 20% of free space in the */var/log/* partition.

* "Inspection failure - not enough free disk space, see sk92907" error in tracker logs

## Cause

Free disk space is below the defined threshold in the log minimum space configuration. For R80.10, R77.30 and earlier versions, refer to [sk124712](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124712).

## Solution

Follow this action plan on the Threat Emulation Gateway:

1.

   ### Delete unneeded files to free disk space

   1. Connect to the command line on the Management Server.
   2. Log in to the Expert mode.
   3. Examine the available disk space:  
      `df -h | grep -E "Avail|/var/log"`
   4. Remove unnecessary large files - old backup files, old log files, debug output files, SmartConsole installation files, and so on ([consult Check Point Support](https://www.checkpoint.com/support-services/contact-support/), if you are not sure):  
      1. `find / -size +500M -type f -exec ls -l {} \;`
      2. `find / -size +200M -type f -exec ls -l {} \;`
      3. `find / -size +100M -type f -exec ls -l {} \;`
2.

   ### Change the threshold of available disk space in the */var/log/* partition at which the Security Gateway should stop scanning files

   If there is enough free disk space, but still less than 20%:
   1. Back up the Security Management Server / Domain Management Server.

      Refer to:
      * [sk108902 - Best Practices - Backup on Gaia OS](https://support.checkpoint.com/results/sk/sk108902)
      * [sk91400 - System Backup and Restore feature in Gaia](https://support.checkpoint.com/results/sk/sk91400)
      * [sk98153 - How to take a snapshot of Endpoint Security Management Server database](https://support.checkpoint.com/results/sk/sk98153)
   2. Close **all** SmartConsole windows.

      Verify by running the "*cpstat mg* " command on the Security Management Server / in the context of *each* Domain Management Server.
   3. Connect with [Database Tool (GuiDBedit Tool)](https://support.checkpoint.com/results/sk/sk13009) to the Security Management Server / Domain Management Server.

   4. In the upper left pane, go to ***Table*** - ***Anti-Malware*** - ***antimalware_misc***.

   5. In the upper right pane, click on ***TESettings_Default***

   6. Press CTRL+F (or go to ***Search*** menu - ***Find*** ) - paste ***stop_adding_files_to_queue_when_disk_space_falls_below*** - click on ***Find Next***.

   7. In the lower pane, right-click on the ***stop_adding_files_to_queue_when_disk_space_falls_below*** - select ***Edit...*** - set the desired value - click on ***OK***.

      **Note:** This value specifies at what percent of available disk space in /var/log/ the Security Gateway should stop scanning files.
   8. Save the changes: go to ***File*** menu - click on ***Save All***.

   9. Close the GuiDBedit Tool.

   10. Connect with SmartConsole (R80 and higher) / SmartDashboard (R77.30 and lower) to the Security Management Server / Domain Management Server.

   11. Install the Access Control and Threat Prevention policy on the relevant Security Gateway / Cluster object.

3.

   ### Increase the size of the /var/log/ partition (if possible)

   Increasing partition sizes (i.e., */var/log/* partition) should be done using the LVM Manager as described in [sk95566 - Managing partition sizes via LVM manager on Gaia OS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95566).

   **Note:** The Gaia Clish command "*set volume logs size \<size in GB\>*" is currently not recommended and should be avoided in this case.

**Related solutions:**

* [](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110555)[sk101149 - "Error: Disk space usage is above allowed value" is displayed in SmartView Monitor for Threat Emulation blade](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101149)[](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106040)
* [sk117634 - MTA and/or TEX and/or TE gateway is not able to upload files for extraction/emulation or parse any e-mails](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117634)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content