search cancel

HDD full for the PAM VM overnight

book

Article ID: 133227

calendar_today

Updated On:

Products

CA Privileged Access Manager - Cloakware Password Authority (PA) CA Privileged Access Manager (PAM) CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

Facing the issue of full hard-disk in on of VM

 

Cause

Looking HDD shows 100% and even xcd_spfd.log was getting a lot of errors while having the error "Session recording mount is unavailable. " Check for errors / warning. In folllowing case having web call service error 404.

2021-12-06 12:29:35  22482 INFO  execute: request [wget -O - --no-check-certificate --header="Cookie: PHPSESSID=8ced183bf200e0ca94e278686a858412" --header='User-Agent: Java' 'http://localhost:8000/serviceController.php?dataEncoding=http_get&service=AuditService&serviceMethod=createLogByKey&deviceId=1323&deviceName=blablabla.mememe.acme&domName=domainacme.mydomain.acme&messageCode=PAM-SPFD-0027&messageParams[]=22482&port=3389&serviceName=&sourceIP=10.55.18.10&taskName=RDP&transType=session_recording&userName=CN=blablabla,OU=blabla,OU=Bla,OU]
2021-12-06 12:29:35  22482 INFO  SessionRecordingQueue: recording max queue size is 200. recording write batch size is 1. recording sleep time is 50
2021-12-06 12:29:35  22482 INFO  refreshRfsStatus: not created/get (/opt/rpath/)
2021-12-06 12:29:35  22482 INFO  refreshRfsStatus: initilizing mount status shm ... (/opt/rpath/)
2021-12-06 12:29:35  22482 INFO  getRfsStatus: Changed mount status to 1 (/opt/rpath/)
2021-12-06 12:29:35  22482 ERROR parseReply: Reply START.
2021-12-06 12:29:35  22482 ERROR parseReply: HTTP/1.1 404 ^M
Content-Type: text/html;charset=utf-8^M
Content-Language: en^M
Content-Length: 1078^M
Date: Mon, 06 Dec 2021 12:29:35 GMT^M
Connection: close^M
^M

Environment

Release : 3.4.0

Component : PRIVILEGED ACCESS MANAGEMENT

Resolution

The problem with logs growing huge requires PAM upgrade to 3.4.1 afterwards 

Resolved Issues in 3.4.1 says:

"20200550 DE443843 After upgrading to PAM 3.3, the logs.bin file sizes are very large"

To workaround the issue do a ssh support session with Broadcom Support Team to remove the huge files manually and restart the PAM instance resolved the issue.