Skip to main content

​
Restore Proxy Operation by Freeing Disk and RAM

Free disk and RAM to restore proxy operation can interrupt web access, policy enforcement, or evidence collection. Use this runbook to restore service, preserve logs, and prove the corrective action during security review. When SafeSquid partitions or RAM are full, the proxy can fail or behave unpredictably. Use the steps below to identify full partitions, clean logs and cache safely, and prevent recurrence.

​
Prerequisites

Give the enough size to backup store. Example: to back up files of size 5GB, allow for a store of 5.5 GB. Don’t delete the original log files (.log extension) and database files.

​
Check disk space

Run the below command to check the available disk space on each partition.
You will see the Used and Available sizes on each partition. Filesystem Size Used Avail Use% Mounted on udev 735M 4.0K 735M 1% /dev tmpfs 150M 428K 149M 1% /run /dev/dm-2 4.9G 4.2G 424M 91% / none 4.0K 0 4.0K 0% /sys/fs/cgroup none 5.0M 0 5.0M 0% /run/lock none 746M 0 746M 0% /run/shm none 100M 0 100M 0% /run/user /dev/sda1 232M 37M 179M 17% /boot /dev/mapper/dev—vg-var+cache+safesquid 1.8G 2.8M 1.7G 1% /var/cache/safesquid /dev/mapper/dev—vg-usr+local+safesquid 1.8G 44M 1.7G 3% /usr/local/safesquid /dev/mapper/dev—vg-var+db+safesquid 15G 193M 14G 2% /var/db/safesquid /dev/mapper/dev—vg-var+log+safesquid 15G 171M 14G 2% /var/log/safesquid

​
/dev/ram1 62M 1.3M 58M 3% /tmp/safesquid

If any of the above partitions is used over 80%, back up the following files. Then delete files as required.

​
Partitions

When the ”/ ” partition is full remove the files from the below paths:

​
/opt/safesquid/bin

change the directory to /opt/safesquid/bin by using the command below:
listing all the contents from /opt/safesquid/bin The default files and folders are: sections modules safesquid -> safesquid-2017.0518.2110.3-swg-concept* You should not delete the tar file which is soft-linked to the SafeSquid file. In the above image, it is: safesquid-2017.0518.2110.3-swg-concept*

​
/var/log

You can also take the backup of system logs and delete the files with the .gz extension. This folder contains the logs related to a system, so don’t delete or modify the original files (i.e. with the .log extension). Example: dmesg.1.gz

​
/var/cache/safesquid

Delete all files from this folder by using the command mentioned below. No need to take a backup of any file from this folder.

​
/var/db/safesquid

Delete all files except these three files from the directory: /var/db/safesquid/report/ safesquid2.db safesquid2.db-wal safesquid2.db-shm These files will be used to store the data required for reports generation you can take a backup or directly delete these files. If you delete or move the above files to another destination, restart the SafeSquid server. This recreates the deleted or moved files.

​
/var/log/safesquid

Change the directory to :/var/log/safesquid/native/ by using the below command
Native logs are used to store the data related to requests and responses. You can delete all files in this folder, no backup is required. Example file name to be deleted: 20161223132118-safesquid.log.gz Change the directory to: /var/log/safesquid/extended/ by using the below command
Extended logs are used to store the data related to users’ information for each connection. Take a backup of these files if required. Example file name to be deleted: 20161223132118-extended.log.gz Change the directory to: /var/log/safesquid/performance/ by using the below command
Performance logs are used to store the data related to safesquid performance statistics. You can take a backup if required and delete it. Example file name to be deleted: 20161223132118-performance.log.gz Change the directory to :/var/log/safesquid/config/ by using the below command
config logs used to store the data related to SafeSquid interface requests and responses. No need to take a backup of these files. Example file name to be deleted: 20161223132118-config.log.gz

​
/tmp/safesquid

Delete all files and folders present in this directory. By using this command
This memory will be used only in upgradation time.

​
Capture useful evidence

Collect evidence before restarting services or changing policy. Keep screenshots, command output, and relevant SafeSquid logs with the incident ticket.
Expected result: the native log prints up to 100 recent lines. Each line starts with a date and time, then a [thread or request id] and a module name such as network:. Record the affected user, source IP address, requested URL, timestamp, browser error, SafeSquid policy section changed, and verification result.

​
Next steps