Log partition on CUCM PUB filling up

[jironside]

I am running CUCM 11.5.1.18900-97 and I am regularly finding reports of the log partition low water mark being exceeded.

I know this isn't a critical issue and when it happens I generally set the water marks down and let it purge. 

However, even when I set it down as low as 25% the actual partition usage on the publisher never drops any lower than about 75%. This means that when I set it back up to 90%, within a month or so it has hit the low water mark again.

I have gone through and turned down a lot of the logging levels for things I rarely if ever need to look at, and manually deleted old traces as well, but it still seems to fill up a lot faster than it did in past years. this is only an issue on this one publisher as the subcriber (and other publishers at different sites) don't suffer from this problem.

Any advice on options for clearing out more data from the log partition and/or keeping it from filling so quickly (while maintaining a reasonable level of logging for troubleshooting purposes)?

Thanks.

[Kaloyan]

Hello,

CDRs don't obey the RTMT watermark. You can adjust the CDR watermarks by going to the Serviceability page > Tools > CDR Management. You can also try manually purging some CDRs from the CAR page to see if that will help.

How much logs you generate depends on the utilization of the services and the trace settings. You can configure the trace detail level, the number of files to be stored for each service, and the size of each log file (e.g.. CM Serviceability > Trace > Configuration > select server > CM Services > CallManager > SDL Configuration > Go (located on the top right in the "Related Links") 

[TomMar1]

Here are some old notes I have.  I have not run into this problem in several years though.

RTMT > Alert Central > System tab
Start with LogPartitionLowWaterMarkExceeded
Right Click > Set Alert Properties
Next > Lower to 10%
Then LogPartitionHighWaterMarkExceeded
Right Click > Set Alert Properties
Next > Lower to 15%
**You can select which servers to clean up when you enter the Alert Properties
***Wait 15 minutes***
Check CLI of node using show status command for freed disk space

[jironside]

So I was dealing with this again today after it hit the watermark again--apparently from the date of the initial post less than a month later.

This time I tried manually purging the CDRs. I purged all the CDR databases from CAR to prune about half of the records. I had RTMT up and running when I did this and was watching the disk usage graph to see if it had any effect, but nothing changed.

Then I used my usual method of setting the watermarks down as tmariutto described, which is what I usually do, and as before, it did free up some disk space. However, I set the HWM all the way down to 15%, and after several hours of letting it run, it had only dropped from 90% used to 76% used. It never seems to get any lower than that. I set the watermarks back up and I am guessing it will be back above 90% in a few weeks.

There must be something else taking up that space that isn't CDR or affected by the HWM purge. Maybe TFTP files? but wouldn't those be on both nodes and not just the pub? Any other thoughts?

Jon