Breadcrumbs

Managing Disk Space in Analysis Cockpit: Safe and Unneeded File Deletion Options

Last update:
Last verified version: AAC 4.4.3

Overview

If your disk is already at or close to 100% and AC no longer works properly, see section Extending ASGARD's Disk Space

If your disk usage is growing too fast and free disk space is running out, you have several options:

  1. Extending ASGARD's Disk Space

  2. Managing Disk Space in Analysis Cockpit: Safe and Unneeded File Deletion Options | Files not needed for operation

  3. Managing Disk Space in Analysis Cockpit: Safe and Unneeded File Deletion Options | Potentially Unneeded / Dated Files

  4. Set the https://analysis-cockpit-manual.nextron-systems.com/en/latest/maintenance/retention.html to automatically delete old data

Files not needed for operation

The following files are safe to delete. They are not needed for AC to operate.

  • /var/log/asgard-analysis-cockpit/*.gz

  • /var/lib/asgard-analysis-cockpit/events/*.ok

They are only kept on the system if needed for further processing. E.g. saving/sending the log files to another system or keeping the THOR scans (found in events) for backup reasons. If you do not need or plan to use those, they can be deleted. If you are unsure make a copy to another system before deleting them.

Potentially Unneeded / Dated Files

This method is only advised as a last resort if increasing your disk space is not an option.

If your Cockpit is running for a long time, there might be data ingested that you no longer need and therefore can be deleted to regain disk space. This includes:

  • Events

  • Reports

Deleting Unneeded Events

Delete only events that are not part of an incident case.
Cases can not be deleted

Therefore only delete scans you no longer need. This can be done by navigating to the Scans dashboard (1) selecting the scans (2) and clicking Delete Events(3/4).

grafik-20260218-125352.png

Another possibility is searching for assets (1/2) which are no longer part of your infrastructure and deleting their events via the Scans (3/4/5) tab.

delete-events (1).png

Deleting Unneeded Reports

Old unneeded reports can be deleted via command line and are found at /var/lib/asgard-analysis-cockpit/reports.

For example, to delete reports created before 1/1/2025, use the following command:

Bash
nextron@cockpit:~$ sudo find /var/lib/asgard-analysis-cockpit/reports/ \
  -mindepth 1 -maxdepth 1 \
  -type d \
  ! -newermt "2025-01-01" \
  -exec rm -rf {} +

The reports are still listed in the UI after removal, but a download attempt will fail.

Related Content