# Moving most consuming directory to the separate disk

In my case, one directory is consuming most of the disk space dedicated for the system.


Stop the service.
```bash
systemctl stop wazuh*
systemctl | grep wazuh
```


Rename directory
```bash
export src="/var/ossec"
mv ${src} ${src}.backup
```


Configure LVM, mount disk to the location [guide](/books/disks-and-partitions/page/lvm), but do not create directory not mount the disk.

```bash
mkdir -p ${src}
export host=$(hostname)
mount /dev/vg-${host}-data/lv-${host}-data ${src}
df -h
```

Add mount point to the fstab. Copy needed line to the buffer and paste it into the /etc/fstab
```bash
mount | grep ${host}
```
```
/dev/mapper/vg--host--data-lv--host--data on /var/ossec type ext4 (rw,relatime)
```
```bash
vi /etc/fstab
```
```
/dev/mapper/vg--host--data-lv--host--data /var/ossec    ext4    errors=remount-ro    0 1
```
```bash
systemctl daemon-reload
mount -a
df -h
```
```bash
Filesystem                                           Size  Used Avail Use% Mounted on
/dev/root                                             29G   20G  8.5G  70% /
tmpfs                                                2.0G     0  2.0G   0% /dev/shm
tmpfs                                                783M 1000K  782M   1% /run
tmpfs                                                5.0M     0  5.0M   0% /run/lock
efivarfs                                              56K   24K   27K  48% /sys/firmware/efi/efivars
/dev/sda16                                           881M   70M  749M   9% /boot
/dev/sda15                                           105M  6.1M   99M   6% /boot/efi
tmpfs                                                392M   12K  392M   1% /run/user/1003
/dev/mapper/vg--host--data-lv--host--data             98G   24K   93G   1% /var/ossec
```



Run the screen (tmux). Move files from backup to new destination 
```bash
tmux a
sudo su
apt install rsync
export src="/var/ossec"
# trailing slash matters! telling copy content, nor directory itself.
rsync -avAXH --progress ${src}.backup/ ${src}
```

Verify integrity (output must be empty)
```bash
# checksums, permissions, timestamps
rsync -avcn --delete ${src}.backup ${src}

# content only
diff -qr ${src}.backup ${src}
```


Verify size
```bash
du -s ${src}
```
```
8905080 /var/ossec
```
```bash
du -s ${src}.backup
```
```
8905676 /var/ossec.backup
```

## Perform VM restart to ensure disk will be mounted and service is working properly
```
shutdown -r now
```



Once happy, remove source
```
export src="/var/ossec"
rm -rf ${src}.backup
```