Hosts Updates

[Armshouse]

Hey folks,

I noticed my disk space usage has suddenly almost doubled. It may be fine and simply as a result of various things I've enabled; one of those was Web Cache, but I'm surprised that it went from 25% up to 44% so quickly - is that expected?

In trying to track down anything I may have done and I was looking around the various reports. A couple I came across were the Hosts Updates and Hosts Events reports. As you can see from the graph, on June 1st something happens that suddenly causes the activity to go from around 60ish every hour to in the region of 1500. Any Ideas what that could be? Looking at Hosts Events, it looks like every minute an event called addTag is happening, is that just how things work with tags? (I use tags to mark devices to shunt them into policies and target in rules).

Sorry for the newbie questions, but couldn't find too much about this on the Wiki or in here. Have also added a screenshot of the All Settings Changes report from 2020-06-01 in case anything jumps out at anyone. FYI, the events re web-cache were literally me just adding two domains to exclude from the cache.

Jump in activity from June 01
Screenshot 2020-06-05 at 20.10.22.png

What is this addTag event updating every minute?
Screenshot 2020-06-05 at 20.11.12.png

Admin actions on June 01
Screenshot 2020-06-05 at 20.15.41.png

[arenfrow]

Hey Armshouse,

In your second screen shot, I can see that 22 'addtag' events occurred in <1 second.

Based off that image, I'm inclined to believe that your tag events are the culprit.

Have you seen a significant influx of devices recently? Or have to recently generated many new tags?

Also, depending on how your tags are set up, you may be applying several tags for any given communication.
If you'd like to share a screen shot of your tag rules I might be able to shed some insight into why there are so many events occurring.

As far as your disk space is concerned, installing Web Cache could certainly increase your disk usage as it needs to store the information for each site you cache.
That being said, it's likely not the only source of your sudden increase in disk usage.

Running the script located at the wiki page below will help you understand what exactly is using up your disk space.
wiki.untangle.com/index.php/Script_-_Disk_Usage_Report

This script won't remove anything, but you'll have a better idea of how to move forward if you wanted to clear some space.

[Armshouse]

Hey, thanks for the reply, please find some answers below...

Have you seen a significant influx of devices recently? Or have to recently generated many new tags?

No, I've about 16 active devices on my (home) network. I did have a go at creating a trigger that added a tag to experiment in pulling that tag into reports, but it didn't work so I deleted it. you can see my tag rules below.

Screenshot 2020-06-05 at 21.41.07.png

Also, depending on how your tags are set up, you may be applying several tags for any given communication.
If you'd like to share a screen shot of your tag rules I might be able to shed some insight into why there are so many events occurring.

In terms of applying tags to devices, I did this initially from the Hosts screen, but I did actually duplicate those tags onto the Devices tab not long ago as I wasn't sure if they needed to be there too. Perhaps this caused some confusion? What's the difference in adding tags in Hosts vs Devices?

As far as your disk space is concerned, installing Web Cache could certainly increase your disk usage as it needs to store the information for each site you cache.
That being said, it's likely not the only source of your sudden increase in disk usage.

Good to know, I'll keep an eye on that as it had usually been around 25% since I installed Untangle.

Running the script located at the wiki page below will help you understand what exactly is using up your disk space.
wiki.untangle.com/index.php/Script_-_Disk_Usage_Report

Where do I run that script?

Thanks again.

[arenfrow]

Tagging a device associates the tag with the MAC address of the device whereas tagging a Host associates the tag with the IP address assigned to a device.

There shouldn't be any conflict if you tag in both locations as their associations are different.

You run the script in the CLI of your Untangle.
You'll need to SSH into it with root@<untangle_IP>
The password will be your admin password.