CUCM 10.0 unable to delete log files active partiton stays upto 99%

[Sadaseeven Saminaden]

Hello.

As the title says, we are unable to purge files using RTMT or lowering thresholds and even collecting/deleting files.

Any suggestions?

Regards

[David Hailey]

It's probably a good idea to double check what trace level settings you have enabled on the cluster and also determine if there may be a related bug of some sort for 10.0...but take a look at the following thread and it will give you instruction on how to do clear out logs via the CLI:

https://supportforums.cisco.com/discussion/10352036/clear-all-logs-cucm-6x#1119096

Hailey

[Sadaseeven Saminaden]

Hello David.

I checked this thread earlier but cannot find any files listed under the mentionned proceedure.

It seems after CUCM 9 the file structure has changed.

Do you have any clue on it?

[George Thomas]

I usually use Remote browse from RTMT to delete it.

[Sadaseeven Saminaden]

Hello George.. Also tried remote browse.. It gives some permission errors for some files, managed to download about 1 GB of file on my PC but does not indicate if deletion is successful or not.

Any hints?

[Sadaseeven Saminaden]

Hello all.. 

We opened a TAC on this issue. 

Had no choice but to rebuild the cluster. 

The Administrator who assisted on provisioning the VMs only gave us 60GB for the HDD and this was partionned into 7G/7G active/inactive partitions that were already being filled up since install.

Unfortunately Cisco TAC said there was no way to resize partitions.

So here we are with a new cluster and license re-hosted.

HTH

Davi

[Brian Meade]

There's a COP file to increase the size of the partitions now: http://www.cisco.com/web/software/282204704/18582/ciscocm.vmware_disk_size_reallocation_v1.0.pdf

Make sure you're VM administrator uses the correct OVA templates for building out the VMs next time: http://docwiki.cisco.com/wiki/Virtualization_for_Cisco_Unified_Communications_Manager_(CUCM)

[Sadaseeven Saminaden]

Hi Brian. 

We went this way earlier as suggested by TAC. 

However this file is for increasing the size of the inactive partition only. 

Our issue was for the active partition and there is no way according to TAC except rebuilding.

Thanks to ESX and Vcenter, it was not too much of a big ordeal.

[Brian Meade]

You can delete the files manually recursively using file delete.  The hard part will be determining the source of all the files.

Do you have any active cores on the node? "utils core active list"

Brian

[Sadaseeven Saminaden]

Hi Brian. No active core files found.. Also, see the output below. Does this look normal?

admin:file list activelog /cm/trace
<dir>   PnP
<dir>   amc
<dir>   auditlog
<dir>   bps
<dir>   capf
<dir>   carsch
<dir>   ccm
<dir>   ccmmib
<dir>   ccmservice
<dir>   cdp
<dir>   cdpmib
<dir>   cdragent
<dir>   cdrrep
<dir>   cef
<dir>   cfrt
<dir>   cmi
<dir>   cms
<dir>   ctftp
<dir>   cti
<dir>   ctlcli
<dir>   ctlprovider
<dir>   dbl
<dir>   dhcpmon
<dir>   dirsync
<dir>   dnaliassync
<dir>   dnaserver
<dir>   ils
<dir>   lbm
<dir>   licensing
<dir>   lpm
<dir>   ris
<dir>   rtmtreporter
<dir>   syslogmib
<dir>   taps
<dir>   tct
<dir>   tvs
<dir>   userlicensing
dir count = 37, file count = 0
admin:

[Brian Meade]

That file structure looks normal to me.  You may need to open a TAC case as they can go into root and find the largest files/directories using du and manually clear them out.  I had to do this a few times when I worked in TAC.

[David Hailey]

The file structure is normal.  If you were to go into the actual sub-directories, you would get an idea of how many trace files are in each (and they correlate in file structure back to various services/components which you can set trace levels on).  Again, it's a good idea to make sure you double check what your trace levels are.  If you have everything set to detailed then you might be generating a lot of traces quickly, particularly in a medium to larger cluster (and even a smaller one depending on various factors).  I would say that, in this case, you should work with TAC to get an idea of what is going on.  It may be very simple and they can do a remote session and help you out.  It could also be a 10.x related issue.

Hailey

[Brian Meade]

I would also look through some of the CDR directories and make sure files aren't being built-up there:

https://supportforums.cisco.com/document/29151/troubleshooting-cucm-5x-6x-cdr-analysis-and-reporting-data-missing-issues

Those files can take up a lot of space if you're failing to write to the billing server.