VM capping out in disk space due to gvmd-split-xml-file

altjx · February 20, 2023, 5:41pm

I ran across this PR while researching this issue, but unfortunately, I’m using gvmd 22.4.0~dev1.

This is an openvas container that I built myself and it works perfectly fine on most of the networks I’ve run it on. However, for some of the larger environments, I noticed that the disk space just continues to cap out.

In my /tmp folder within the openvas container, it’s currently storing 68GB of data:

root@32e2bdfd1ffa:/# du -sh * 2>/dev/null
0	bin
4.0K	boot
28K	dev
2.2M	etc
4.0K	gvm-openvas
4.0K	gvm_service_monitor.sh
1.8M	home
0	lib
0	lib32
0	lib64
0	libx32
4.0K	media
4.0K	mnt
6.9M	opt
0	proc
1.2G	root
228K	run
0	sbin
4.0K	srv
0	sys
68G	tmp
3.1G	usr
4.7G	var

When looking in /tmp/, all I see is this:

root@32e2bdfd1ffa:/# ls tmp/
GBCommunitySigningKey.asc   gvmd-split-xml-file-ADxHQb  gvmd-split-xml-file-LM7cVQ  gvmd-split-xml-file-WcnNpg  gvmd-split-xml-file-imkpgj  gvmd-split-xml-file-t8bcGw
core-js-banners             gvmd-split-xml-file-AQEdrD  gvmd-split-xml-file-LvEOmk  gvmd-split-xml-file-XYjIVo  gvmd-split-xml-file-jNSHw2  gvmd-split-xml-file-tdSZGX
gvmd-split-xml-file-0tz4Kh  gvmd-split-xml-file-ASHnL3  gvmd-split-xml-file-MpqHyo  gvmd-split-xml-file-XpI0Kd  gvmd-split-xml-file-jRJrJW  gvmd-split-xml-file-u4y7hW
gvmd-split-xml-file-18dGGw  gvmd-split-xml-file-AeHkc0  gvmd-split-xml-file-N0pnrV  gvmd-split-xml-file-YZdYwA  gvmd-split-xml-file-kLnMEd  gvmd-split-xml-file-uXqJlS
gvmd-split-xml-file-1K93YO  gvmd-split-xml-file-B8Wd0D  gvmd-split-xml-file-NX0VST  gvmd-split-xml-file-YxgEW6  gvmd-split-xml-file-kVsDl9  gvmd-split-xml-file-ujcouZ
gvmd-split-xml-file-1KHB81  gvmd-split-xml-file-BIJHhL  gvmd-split-xml-file-Oo049L  gvmd-split-xml-file-ZS8t1M  gvmd-split-xml-file-lASyhY  gvmd-split-xml-file-uqE8Im
gvmd-split-xml-file-2KRsiz  gvmd-split-xml-file-CNC9aL  gvmd-split-xml-file-PdugzB  gvmd-split-xml-file-ZmXljd  gvmd-split-xml-file-lPLxwM  gvmd-split-xml-file-v9dWrA
gvmd-split-xml-file-2MLpEy  gvmd-split-xml-file-CPrLFQ  gvmd-split-xml-file-QR13jp  gvmd-split-xml-file-b4Yc7K  gvmd-split-xml-file-mgF8k0  gvmd-split-xml-file-vcYpm4
gvmd-split-xml-file-2ngQcC  gvmd-split-xml-file-DOLwo2  gvmd-split-xml-file-Qgno9B  gvmd-split-xml-file-bCDOZw  gvmd-split-xml-file-nmEDLS  gvmd-split-xml-file-vnnvqX
gvmd-split-xml-file-35KUxC  gvmd-split-xml-file-Dr4K2t  gvmd-split-xml-file-Ql2XGU  gvmd-split-xml-file-bl038N  gvmd-split-xml-file-o8hE3z  gvmd-split-xml-file-vtklYF
gvmd-split-xml-file-3c7jAm  gvmd-split-xml-file-EPmuCX  gvmd-split-xml-file-R7fxYq  gvmd-split-xml-file-bmx9Wu  gvmd-split-xml-file-oDwfJe  gvmd-split-xml-file-vutAo3
gvmd-split-xml-file-3eeoWE  gvmd-split-xml-file-EPrhej  gvmd-split-xml-file-RSVB2T  gvmd-split-xml-file-crJQfo  gvmd-split-xml-file-oFY4oD  gvmd-split-xml-file-wYtIV2
gvmd-split-xml-file-3jGhCk  gvmd-split-xml-file-EY8R1D  gvmd-split-xml-file-RnCcln  gvmd-split-xml-file-cv3gbS  gvmd-split-xml-file-oQpPNf  gvmd-split-xml-file-wdspNe
gvmd-split-xml-file-4Ns2V9  gvmd-split-xml-file-EacgVR  gvmd-split-xml-file-RwGa8L  gvmd-split-xml-file-dDOOe7  gvmd-split-xml-file-obzHiI  gvmd-split-xml-file-x2uVXL
gvmd-split-xml-file-4U2ntJ  gvmd-split-xml-file-EpJxpz  gvmd-split-xml-file-S1yASw  gvmd-split-xml-file-dO58mu  gvmd-split-xml-file-ocg0hO  gvmd-split-xml-file-xl1nMG
gvmd-split-xml-file-4s1Ltl  gvmd-split-xml-file-F3twdX  gvmd-split-xml-file-SnlLDg  gvmd-split-xml-file-dcVn2e  gvmd-split-xml-file-oyzUX0  gvmd-split-xml-file-ySsgPQ
gvmd-split-xml-file-4uPiJl  gvmd-split-xml-file-FIvDxJ  gvmd-split-xml-file-Sxxp5x  gvmd-split-xml-file-dtYoMM  gvmd-split-xml-file-p125je  gvmd-split-xml-file-yUaOYE
gvmd-split-xml-file-5FwCJ0  gvmd-split-xml-file-G1VGZC  gvmd-split-xml-file-TORdvf  gvmd-split-xml-file-edKJNN  gvmd-split-xml-file-pAbshn  gvmd-split-xml-file-zFYn4G
gvmd-split-xml-file-5U7EKZ  gvmd-split-xml-file-H6cNOC  gvmd-split-xml-file-TqMFZV  gvmd-split-xml-file-eznVw1  gvmd-split-xml-file-pGN0v7  gvmd-split-xml-file-zRpG5h
gvmd-split-xml-file-5kWzIY  gvmd-split-xml-file-HOfJp3  gvmd-split-xml-file-U3IaOF  gvmd-split-xml-file-fTDqKw  gvmd-split-xml-file-pGpiBV  gvmd-split-xml-file-zTOJxN
gvmd-split-xml-file-6RFQWt  gvmd-split-xml-file-HjxaGe  gvmd-split-xml-file-U7wvrS  gvmd-split-xml-file-fiWbXY  gvmd-split-xml-file-pLWbYN  openvas-gnupg
gvmd-split-xml-file-6ckf5T  gvmd-split-xml-file-HmlYdl  gvmd-split-xml-file-UJsiHU  gvmd-split-xml-file-fsPoYE  gvmd-split-xml-file-pdT4SS  ownertrust.txt
gvmd-split-xml-file-7Pl1u5  gvmd-split-xml-file-HoZ06g  gvmd-split-xml-file-UNzic7  gvmd-split-xml-file-gNvftH  gvmd-split-xml-file-qOKoPE  pymp-37do5kvf
gvmd-split-xml-file-8S5pJa  gvmd-split-xml-file-I5gyft  gvmd-split-xml-file-USW4Hs  gvmd-split-xml-file-gvNYYv  gvmd-split-xml-file-qe76Zi  v8-compile-cache-0
gvmd-split-xml-file-8akkPv  gvmd-split-xml-file-I84jY0  gvmd-split-xml-file-Ur0jxC  gvmd-split-xml-file-h6wdtO  gvmd-split-xml-file-qlYKEX  yarn--1675466716275-0.20521315602725831
gvmd-split-xml-file-9TVSi6  gvmd-split-xml-file-IMz0jz  gvmd-split-xml-file-W3pDig  gvmd-split-xml-file-hKQjMq  gvmd-split-xml-file-qqdyYk  yarn--1675466720067-0.13768213910624172
gvmd-split-xml-file-9xZISc  gvmd-split-xml-file-JNPpxp  gvmd-split-xml-file-WWGtte  gvmd-split-xml-file-hpOPQm  gvmd-split-xml-file-rYzgwh
gvmd-split-xml-file-A5ktpr  gvmd-split-xml-file-LHZFEU  gvmd-split-xml-file-WbasHy  gvmd-split-xml-file-iPlSfn  gvmd-split-xml-file-rpnO67

Any idea what I should do here? This is definitely quite interesting.

bricks · February 21, 2023, 8:49am

Just delete the files

They are used to avoid consuming a lot of RAM and running into the OOM killer while gvmd is parsing the SCAP data (CPEs and CVEs). They should be deleted automatically. Not sure why this didn’t happened.

altjx · February 21, 2023, 1:06pm

Ahh ok gotcha lol. That’s really good to know. Would it screw anything up if I just simply created a cron job to wipe that folder every minute?

Also I’m guessing these files are being created during the scan and not only before the scan?

bricks · February 21, 2023, 1:10pm

These files are created during a feed update of the SCAP data only.

altjx · February 21, 2023, 1:12pm

Ahh ok this is good to know. Much appreciated!

okamel · June 22, 2023, 2:32pm

I have the same problem. The hard disk is full in several systems in a couple of hours. As manual deletion was not an option anymore I had to create cronjobs. This still does not explain why this happens, the files had been automatically deleted in the past. Any Answer for that?
Thank you!