Disk Usage Troubleshooting - Disk expansion


In this article, we will talk about the problems that may arise due to critical disk usage in your Logsign server and the process of expanding the disk.

Disk Usage

Logsign uses a disk with Logical Volume Management (LVM) structure for system files and logs. You can check the current disk usage from the following indicators:

  • Logsign dashboard


  • Logsign event panel


  • Or by connecting to Logsign via SSH and checking the disk status using the following command:

Bash: df -h


When the disk usage rate reaches around 80%, you need to decide whether to expand the disk or move your existing logs to another location. When the system disk usage increases and reaches the threshold, logging will stop.

Let's continue by explaining this situation with the disk expansion operation.

- If you are using Logsign on a physical server, you can insert a new disk into the server disk slot for disk expansion and start the process by rebooting the server.

- If you are using a virtual platform, adding a new disk is sufficient for the disk expansion process. No updates should be made on the disks that are already connected to Logsign. The entire disk to be added must be reserved (thick provision). After the disk addition process is completed, you can run the following command to make the system recognize the new disk:


  • for host in `ls /sys/class/scsi_host/`;do
    echo "- - -" >/sys/class/scsi_host/${host}/scan;

1- Before starting the process, we need to open a screen to prevent our operations from being interrupted in case of any problem.

Bash: Screen -S umit



After performing the disk addition process, we check our disk with the lsblk command. We note our new disk's volume directory as sdd.

Bash: lsblk


2- We add our physical disk to our system with the following command.

Note: We noted the volume disk directory as sdd, do not forget to update it with your actual disk path in the command line.

Bash: pvcreate /dev/sdd


3- After listing the existing volume groups, we note the name of the volume group to which the disk expansion process will be performed.

Bash: vgdisplay


4- We include our new disk in the current volume group.

Note: Do not forget to update the volume group and volume directory that you have noted.

Bash: vgextend vglogsign /dev/sdd


5- You can check the area added to the volume group as follows:

Bash: vgdisplay


6- After updating the volume group with the added disk, we run the following command to ensure that the changes are made with the local volume group.

Note: Do not forget to update the volume group that you have noted.

Bash: lvextend -l+100%FREE /dev/vglogsign/root


7- You can run the following command to check the operation. You can observe that the free area is completely transferred as a result of the process.

Bash: vgdisplay


8- Let's use the following command to complete the expansion process and apply the changes.

Note: Do not forget to update the volume group that you have noted. This process may take a long time depending on the capacity of the disk to be added.

Bash: resize2fs -p /dev/mapper/vglogsign-root


9- The process is complete, and you can use the following command to check.

Bash: df -h

Was this article helpful?
0 out of 0 found this helpful

Articles in this section

See more
Become a Certified Logsign User/Administrator
Sign-up for Logsign Academy and take the courses to learn about Logsign USO Platform in detail. Enjoy the courses, and get your badges and certificates. In these courses, you'll learn how to use Logsign in your work and add value to your career.
Visit Our Blog
Our Logsign USO Platform illustrate our expertise. So do the blog. Through our blog posts, deepen your knowledge on various SecOps topics or get updated about important news & modern approaches for cybersecurity. Get into the habit of reading valuable information provided by Logsign. Be a step ahead.