VNX: Sudo logging for root user is causing /var/log/secure files to grow and filling up CS root partition (Dell EMC Correctable)
Summary: This article discusses how to disable sudo logging for root as it can cause /var/log/secure files to grow and fill up CS root partition.
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
Upgraded to 7.1.76 or later.
Control Station root partition is filling up regularly:
/var/log/secure files are abnormally large.
The secure files are mainly filling up with messages like the below:
Control Station root partition is filling up regularly:
Feb 26 04:03:09 2017:CS_PLATFORM:ADMIN:CRITICAL:24:::::dskMon[14269]: FS /dev/hda3 mounted on / filling up (at 93%, max = 90%).
Feb 27 04:03:05 2017:CS_PLATFORM:ADMIN:CRITICAL:24:::::dskMon[25473]: FS /dev/hda3 mounted on / filling up (at 94%, max = 90%).
Feb 28 04:03:05 2017:CS_PLATFORM:ADMIN:CRITICAL:24:::::dskMon[29396]: FS /dev/hda3 mounted on / filling up (at 95%, max = 90%).
Feb 27 04:03:05 2017:CS_PLATFORM:ADMIN:CRITICAL:24:::::dskMon[25473]: FS /dev/hda3 mounted on / filling up (at 94%, max = 90%).
Feb 28 04:03:05 2017:CS_PLATFORM:ADMIN:CRITICAL:24:::::dskMon[29396]: FS /dev/hda3 mounted on / filling up (at 95%, max = 90%).
/var/log/secure files are abnormally large.
The secure files are mainly filling up with messages like the below:
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f SCCS/p.export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/usr/local/bin/sccs enter export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f ,export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/usr/local/bin/sccs edit export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f SCCS/z.netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/ln netd netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/usr/local/bin/sccs deledit -y-rw-r--r-- 1 nasadmin nasadmin 0 Mar 6 06:11 netd netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/usr/local/bin/sccs enter export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f ,export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/usr/local/bin/sccs edit export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f export.shares.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f SCCS/z.netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/rm -f netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/bin/ln netd netd.l
Mar 6 06:11:50 VG8_CS0 sudo: root : TTY=unknown ; PWD=/nbsnas/server/vdm/vdm_18 ; USER=nasadmin ; COMMAND=/usr/local/bin/sccs deledit -y-rw-r--r-- 1 nasadmin nasadmin 0 Mar 6 06:11 netd netd.l
Cause
Hourly nasdb backup runs as root. Starting 7.1.76, the code was edited such that some commands in nasdb backup were run using sudo.
By default, sudo events for root are logged to /var/log/secure.
By default, sudo events for root are logged to /var/log/secure.
Resolution
A permanent fix for this issue is in progress. Please contact DELL EMC Support and reference this article.
Affected Products
VNX1 SeriesProducts
VNX1 SeriesArticle Properties
Article Number: 000059216
Article Type: Solution
Last Modified: 06 Nov 2025
Version: 3
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.