NSRL sort out of space

[suman.beros]

I'm installing and indexing NSRL database to use with autopsy and apparently running out of space to complete the sort.  My system shows 11.6 GB of free space.  However, /tmp shows only 1008.0 KB of free space.  The external drive on which the NSRLFile.txt (6.3 GB) is located shows 174.2 GB free space.  Any suggestions what to do to help sort successfully complete?  Thanks.

suman@G41-Forensic-1:~$ cd /home/suman/Desktop/autopsy-2.21
suman@... make

   Autopsy Forensic Browser Installation

perl found: /usr/bin/perl (version 5.010000)
autopsy already exists, overwrite? (y/n):
y
A configuration file already exists, overwrite? (y/n):
y

---------------------------------------------------------------

grep found: /bin/grep
file found: /usr/bin/file
md5 found: /usr/bin/md5sum
sha1 found: /usr/bin/sha1sum

---------------------------------------------------------------

Searching for Sleuth Kit Installation.
Found in: /usr/local/bin/
  Version 3.0.1 found
  Required version found

---------------------------------------------------------------

The NIST National Software Reference Library (NSRL) contains
hash values of known good and bad files.
         http://www.nsrl.nist.gov

Have you purchased or downloaded a copy of the NSRL (y/n) [n]
y
Enter the directory where you installed it:
/media/SBBackup/Downloads/NIST/NSRL
  NSRL database was found (NSRLFile.txt)
  NSRL Index file not found, do you want it created? (y/n) [n]:
y

-------------- begin hfind output --------------
/usr/bin/sort: write failed: /tmp/sortWX2Npz: No space left on device
Error creating process (Error sorting index file using /usr/bin/sort -o "/media/SBBackup/Downloads/NIST/NSRL/NSRLFile.txt-md5.idx" "/media/SBBackup/Downloads/NIST/NSRL/NSRLFile.txt-md5-ns.idx") (nsrl_makeindex)
--------------- end hfind output ---------------

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Tim-114]

> I'm installing and indexing NSRL database to use with autopsy and
> apparently running out of space to complete the sort.  My system
> shows 11.6 GB of free space.  However, /tmp shows only 1008.0 KB of
> free space.  The external drive on which the NSRLFile.txt (6.3 GB)
> is located shows 174.2 GB free space.  Any suggestions what to do to
> help sort successfully complete?  Thanks.

I've run into this before too.  In my book, /tmp shouldn't be used for
anything automated, so I typically neuter it in space and mounting
properties upon installation of most of my systems.  To fix sorter's
ill-advised, implicit use of /tmp, I think you can set $TMPDIR to
override where sort stores it's tempfiles.  It's been a while since
I've used sorter though, so YMMV.

Hope that helps.
tim

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Simson Garfinkel-3]

The real thing we need to do is to rewrite sorter in C++ or java...

On Oct 14, 2009, at 10:46 PM, Tim wrote:

>> I'm installing and indexing NSRL database to use with autopsy and
>> apparently running out of space to complete the sort.  My system
>> shows 11.6 GB of free space.  However, /tmp shows only 1008.0 KB of
>> free space.  The external drive on which the NSRLFile.txt (6.3 GB)
>> is located shows 174.2 GB free space.  Any suggestions what to do to
>> help sort successfully complete?  Thanks.
>
> I've run into this before too.  In my book, /tmp shouldn't be used for
> anything automated, so I typically neuter it in space and mounting
> properties upon installation of most of my systems.  To fix sorter's
> ill-advised, implicit use of /tmp, I think you can set $TMPDIR to
> override where sort stores it's tempfiles.  It's been a while since
> I've used sorter though, so YMMV.
>
> Hope that helps.
> tim
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart  
> your
> developing skills, take BlackBerry mobile applications to market and  
> stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[suman.beros]

Tim, thanks.  Your suggestion worked.  I added TMPDIR="/home/suman/Desktop" to my .profile and rerun autopsy make.  Once it completed, I removed TMPDIR="/home/suman/Desktop" from .profile and restarted.  Autopsy now sees and uses indexed NSRL.  Thanks again.

Interesting:  /tmp now shows 11.6 GB free space.  I'm running ubuntu 9.04.

Tim wrote:

I'm installing and indexing NSRL database to use with autopsy and
apparently running out of space to complete the sort.  My system
shows 11.6 GB of free space.  However, /tmp shows only 1008.0 KB of
free space.  The external drive on which the NSRLFile.txt (6.3 GB)
is located shows 174.2 GB free space.  Any suggestions what to do to
help sort successfully complete?  Thanks.
    

I've run into this before too.  In my book, /tmp shouldn't be used for
anything automated, so I typically neuter it in space and mounting
properties upon installation of most of my systems.  To fix sorter's
ill-advised, implicit use of /tmp, I think you can set $TMPDIR to
override where sort stores it's tempfiles.  It's been a while since
I've used sorter though, so YMMV.

Hope that helps.
tim

__________ Information from ESET NOD32 Antivirus, version of virus signature database 4509 (20091015) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com




  

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Tim-114]

> The real thing we need to do is to rewrite sorter in C++ or java...


Yes, it needs to be rewritten.  I hope you meant C or Java though.
C++ is an abomination.

cheers,
tim

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org