[RESOLVED] /var/tmp on Freenas CIFS share getting filled up by VeeamAgent?

[hooah212002]

I use a Freenas server as the target of a single physical machine using the VeeamAgent. However, yesterday I noticed that the /var/tmp directory was full (5gb) of files named "VeeamAgent2a24e31a-01d2-4842-9793-7b518821bfcf" where everything after "VeeamAgent" was different and each file was exactly 21281560 bytes (~21 MB). I tried to view it with cat but it looks to be encrypted. Plus, the timestamps are at precisely every 4 hours but none line up with the times my backups run. I am thus far unable to capture a process that is creating these files.

[PTide]

Hi,

Are you 100% it's freeNAS? If so, then have you ever attempted to add the server as a repository to VBR? The questions might be strange, but you never know...

Thanks!

[Dima P.]

hooah212002,

Can you please clarify the extension for the mentioned agent files? Thank you!

[hooah212002]

Are you 100% it's freeNAS? If so, then have you ever attempted to add the server as a repository to VBR? The questions might be strange, but you never know...

Yes, i am 100% sure it is freenas (I built it) and yes, it was previously added as a repository but is no longer used by VBR, only the agent. I removed the entry today but the files are still being produced.

[hooah212002]

Can you please clarify the extension for the mentioned agent files? Thank you!

There is no file extension

[PTide]

Ok, just wanted to double-check, because I remember dealing with situations when people with inherited infrastructures would be wrong about what they actually had at their disposal

Such files can be seen on linux-based repositories where Veeam service is deployed. I am not sure how that could happen to your NAS, but it looks like someone have managed to add it not as a CIFS share repo, but as a linux repo. If that's the case, then I'd love to know the story how it was done with freeNAS. Regarding the actual problem - as you understand, since VAW accesses your freeNAS via CIFS it cannot really put anything into /var/tmp/. Also this part

he timestamps are at precisely every 4 hours but none line up with the times my backups run

makes me think that it is really something else what accesses the host. You should double-check if the server is still defined anywhere in VBR (as a repository, or under "managed servers").

Thanks!

[hooah212002]

That did it. I removed it as a backup repository but forgot to also remove it as a "managed server". I've rebooted the windows server (it's actually my VBR server) a couple times and those files are no longer appearing. Cheers!

[mlovelace]

I'm glad to see you got this sorted out. If you wouldn't mind updating the freeNAS post with the fix, in the off chance someone else has a similar problem and stumbles across it, it would be appreciated.