If you have real-time alerts running, these are probably the files associated with those alerts. You might be able to reduce the disk usage by changing the default saved TTL (time to live) in limits.conf , but I am not sure that will work for this problem. But perhaps a better way is to limit the role that is running these searches. If you just look at the Settings->Searches on your search head, you can probably figure out the user, and by extension, the role. You can then cut back the disk quota for that role. On the other hand, you may find that this is actually important data that is necessary for your alerts to work properly. ... View more

Wow.. this one works like a miracle...Thanks a lot @dart Just one thing. it totally ignores and removes the timestamp section in the beginning. How can I retain that and still be able to parse the json? ... View more

I had a similar issue on CentOS 6.4 (minimal install). Resolved it by running yum install firefox This installed tons of dependencies 39 dependencies plus firefox (40 packages in all). After this, the "included" version of firefox that pdfserver uses was able to run and generate reports. ... View more