Symantec Critical System Protection (SCSP) is filling up the root partition of a NetBackup Appliance.

Problem

Symantec Critical System Protection (SCSP) is filling up the root partition of a NetBackup Appliance.  An excessive buildup of .csv files in /var/log/scsplog is resulting in a full disk.

Cause

Symantec Critical System Protection (SCSP), when IPS enabled, will log every root executed command.  This includes logging of all commands run by NetBackup daemons.  Since NetBackup daemons continuously run commands, a large amount of logs can be generated.

Solution

Set the retention based on the number of files vs retention period.

1. Review the current retention via the CLISH:

CLISH>Monitor>SCSP>Audit ShowSettings
  +-----------------------+
  |  Retention Settings   |
  |-----------------------|
  |Retention Period (Days)|
  |-----------------------|
  |          30           |
  +-----------------------+

2. Set the retention for the SCSP logs

Using the CLISH
Retention Period: CLISH>Monitor>SCSP>Audit SetSettings RetentionPeriod <days>
FileNumber: CLISH>Monitor>SCSP>Audit SetSettings FileNumber <files>

Note: Both values above should be numeric

OR
 
Using the web admin console (see Figure below):
 https://<appliance_hostname>  > Monitor > SCSP Audit Logs > Set log retention

Applies To

This issue was originally reported against a NetBackup 5220 Appliance running version 2.5.1.

Other versions and Appliances may also be affected by this issue.