Security Onion VM taking up a LOT (1 TB) of space

[amlamarra]

I created a Security Onion VM and did a PCI passthrough of a spare NIC I had for the packet captures. This has been running for a few months now and has been working great...

Until I noticed that my 2 TB pool was at 80% capacity. Mostly thanks to the Security Onion VM that's taking up 1 TB of space for some reason!

Now I know what you're thinking. "Surely all those packet captures are taking up all your space!"
The thing is, I only gave this VM a 300 GB hard drive and 16 GB of RAM. The packet captures are currently taking up 163 GB of space and are limited to a 200 GB parition.

Here's an even stranger thing. As you can see from that screenshot, I have the VM stored in the "VirtualMachines" dataset. However, when I SSH to Truenas and check where that's mounted to, nothing shows up!

Code:

root@truenas ~ # ls -lA /mnt/storage/VirtualMachines/
total 0

 

[danb35]

However, when I SSH to Truenas and check where that's mounted to, nothing shows up!

That's perfectly normal--you're using zvols for your virtual disks, and those don't show up as files.

But why that zvol is taking that much space, I'm not sure. Snapshots would be one possibility though.

 

[amlamarra]

Thank you.

And I hadn't looked into snapshots being the reason... I'll check that out.

 

[amlamarra]

I deleted all the snapshots for that "SecurityOnion-k1kloh" Zvol and that seems to have been culprit. It's now taking up 305 GB. That's fair since I gave it a 300 GB drive. Thanks for the help.

Now I'm going to have to modify my periodic snapshot task so it doesn't snapshot the entire pool.