{"id":532,"date":"2026-09-08T01:27:12","date_gmt":"2026-09-07T23:27:12","guid":{"rendered":"https:\/\/nutanix.ma\/?p=532"},"modified":"2026-09-08T01:41:25","modified_gmt":"2026-09-07T23:41:25","slug":"clearing-home-log-audit-disk-space-alert-prism-central","status":"publish","type":"post","link":"https:\/\/nutanix.ma\/index.php\/2026\/09\/08\/clearing-home-log-audit-disk-space-alert-prism-central\/","title":{"rendered":"How to resolve the disk space alert on Prism Central"},"content":{"rendered":"\n

This one turns up on almost every Prism Central deployment eventually: a warning alert saying disk space usage for \/home\/log\/audit<\/code> has exceeded 75%. It looks alarming \u2014 a full filesystem on the management plane is not something you want to ignore \u2014 but in most cases it’s routine housekeeping rather than a fault. The audit log has simply been rotating for months and nobody has cleared the archives.<\/p>\n\n

Here’s what the alert means, how to confirm what’s actually consuming the space, and how to clear it safely. The figures below are from a real Prism Central VM I cleaned up recently.<\/p>\n\n

What the alert is telling you<\/h2>\n

The alert comes from the Prism Central VM itself, not from a cluster:<\/p>\n\n

\"Prism
Warning alert on the Prism Central VM \u2014 audit log usage above 75%.<\/figcaption><\/figure>\n\n

One thing that confuses people the first time: the alert names \/home\/log\/audit<\/code>, but when you go looking with df<\/code> you’ll find the filesystem mounted at \/var\/log\/audit<\/code>. They’re the same storage \u2014 \/var\/log\/audit<\/code> is backed by a dedicated loop device that lives under \/home<\/code>. Don’t waste time hunting for two separate problems.<\/p>\n\n

The threshold is 75%, and the partition is small \u2014 378 MB on this PCVM. It doesn’t take much to trip it.<\/p>\n\n

Step 1 \u2014 Look at what’s actually in there<\/h2>\n

SSH to the Prism Central VM and list the audit directory, oldest first:<\/p>\n\n

nutanix@PCVM$ sudo ls -latr \/home\/log\/audit<\/code><\/pre>\n\n
On this system that returned the active audit.log<\/code> plus nine rotated archives, audit.log.1<\/code> through audit.log.9<\/code>. Each archive was roughly 30 MB \u2014 auditd had been rotating at that size and keeping nine generations, so about 270 MB of the 378 MB partition was historical logs.<\/p>\n\n
Step 2 \u2014 Confirm the filesystem usage<\/h2>\n\n
nutanix@PCVM$ df -h \/var\/log\/audit<\/code><\/pre>\n\n
Before the cleanup this showed 294 MB used of 378 MB \u2014 80% full<\/strong>, with only 76 MB free. That matches the alert, and it confirms the archives are the cause rather than something unexpected filling the partition.<\/p>\n\n
This check matters. If df<\/code> shows the partition full but the directory listing doesn’t account for the space, you have a different problem \u2014 a deleted file still held open by a process, most likely \u2014 and deleting archives won’t help you.<\/p>\n\n
Step 3 \u2014 Remove the rotated archives<\/h2>\n
Once you’ve confirmed the archives are what’s filling the partition, remove them:<\/p>\n\n
nutanix@PCVM$ rm -f \/home\/log\/audit\/audit.log.*<\/code><\/pre>\n\n
Note the glob carefully. audit.log.*<\/code> matches the numbered archives \u2014 audit.log.1<\/code>, audit.log.2<\/code> and so on \u2014 but not<\/strong> the active audit.log<\/code> itself. That’s deliberate: you don’t want to delete the file auditd currently has open, because removing it out from under the daemon leaves the space allocated until auditd is restarted, and you’d be no better off.<\/p>\n\n
Step 4 \u2014 Confirm you’ve got the space back<\/h2>\n\n
nutanix@PCVM$ df -h \/var\/log\/audit<\/code><\/pre>\n\n
\"Terminal
Before and after \u2014 the same commands, run either side of the cleanup.<\/figcaption><\/figure>\n\n
The result on this PCVM:<\/p>\n\n
    \n
  • Used space dropped from 294 MB to 24 MB<\/strong>.<\/li>\n
  • Utilisation dropped from 80% to 7%<\/strong>.<\/li>\n
  • Free space went from 76 MB to 346 MB of 378 MB<\/strong>.<\/li>\n<\/ul>\n\n\n
    The alert clears during the next NCC, either by running on PCVM using ssh “ncc health_checks run_all” or through the GUI.<\/p>\n\n\n\n
    <\/p>\n","protected":false},"excerpt":{"rendered":"
    This one turns up on almost every Prism Central deployment eventually: a warning alert saying disk space usage for \/home\/log\/audit has exceeded 75%. It looks alarming \u2014 a full filesystem on the management plane is not something you want to ignore \u2014 but in most cases it’s routine housekeeping rather than a fault. The audit […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-532","post","type-post","status-publish","format-standard","hentry","category-nutanix"],"_links":{"self":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/comments?post=532"}],"version-history":[{"count":7,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/532\/revisions"}],"predecessor-version":[{"id":539,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/532\/revisions\/539"}],"wp:attachment":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/media?parent=532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/categories?post=532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/tags?post=532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}