Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

AWS Disk Full? Why Deleting Logs Might Kill Your Database (And How to Fix It)

Phase 1: Diagnosis (Don’t Panic, Verify) Before you run any "fix" commands, you need to confirm two things: Is the disk actually full? Is InnoDB actually corrupted, or just stopped? First, check the disk usage. 99% of the time, this i…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Phase 1: Diagnosis (Don’t Panic, Verify)



Before you run any "fix" commands, you need to confirm two things:




  1. Is the disk actually full?

  2. Is InnoDB actually corrupted, or just stopped?



First, check the disk usage. 99% of the time, this is the root cause.



df -h



If you see /dev/xvda1 at 100%, you have your culprit. But here is where most people mess up: Do not just start deleting random files.



You need to find what is taking up space without touching the database files yet. Go to your data directory (usually /var/lib/mysql or /opt/bitnami/mysql/data on AWS images) and check the file sizes:



cd /var/lib/mysql

du -h --max-depth=1 | sort -hr



If you see a massive list of mysql-bin.0000X files, those are binary logs. They are safe to purge later, but if you delete them now while the process is hung, you risk breaking the replication chain or crash recovery.



Next, check the logs to see if InnoDB is screaming for help.



tail -n 100 /var/log/mysql/error.log



You are looking for the "Red Flag" error:



[ERROR] InnoDB: Attempted to open a previously opened tablespace. Previous tablespace mysqldb/users uses space ID: 5 at filepath: ./mysqldb/users.ibd



Or the classic:



[ERROR] InnoDB: Page [page id: space=0, page_number=5] log sequence number 123456 is in the future!



If you see these, standard restarts won't work. The database is in a "Crash Loop." It tries to start, reads the corrupted file, panics, and shuts down.



Phase 2: The Surgical Fix (The Scary Part)



If you see those InnoDB corruption errors, standard restarts will fail. You need to force the engine to start in "Read Only" mode so you can extract your data.



Warning: This process involves innodb_force_recovery. It is powerful, but if you use it wrong, you can permanently delete data.



Step 1: Stop everything. Ensure the service is dead.



sudo service mysql stop



Step 2: The Magic Config Open your MySQL configuration file (usually /etc/mysql/my.cnf or /opt/bitnami/mysql/conf/my.cnf).



Add this line under the [mysqld] section:



[mysqld]

innodb_force_recovery = 1



How this works:




  • Start with 1. This tells InnoDB to ignore corrupt pages and let you read the rest.

  • If it doesn't start, change it to 2, then 3, up to 4.


  • DANGER ZONE: Levels 5 and 6 are destructive. Do not use them unless you have a snapshot backup and know exactly what you are doing.



Step 3: Start and Dump Start the service again. If it comes up without crashing—congratulations. You are in "Life Support" mode. The database is read-only.



Now, get your data out immediately:



mysqldump -u root -p --all-databases --routines --triggers > /tmp/full_backup.sql



This command exports everything—tables, views, triggers—into a single file. Once this finishes, check the file size to make sure it looks right.



ls -lh /tmp/full_backup.sql



If that file exists and has size, you have successfully saved the company's data.



Phase 3: The Rebuild (Fresh Start)



Now that your data is safe in /tmp/full_backup.sql, it’s time to fix the corrupted engine. We are not going to try to "repair" the files (which rarely works). We are going to nuke them and rebuild.



1. Stop the service again.



sudo service mysql stop



2. Remove the recovery flag. Go back to my.cnf and **remove **or comment out the line we added earlier:



# innodb_force_recovery = 1 <-- Comment this out!



3. Move the corrupted data. Do not rm it yet! Move it to a backup folder just in case.



sudo mv /var/lib/mysql /var/lib/mysql_corrupted_backup



4. Initialize a fresh instance. Create a new, empty data directory.



sudo mkdir /var/lib/mysql

sudo chown mysql:mysql /var/lib/mysql

sudo mysqld --initialize --user=mysql



5. Start and Import. Start the service. It should come up instantly because it's empty. Now, pour your data back in:



mysql -u root -p < /tmp/full_backup.sql



Conclusion: Don't Let It Happen Again

You saved the database, but you haven't fixed the root cause. If you don't set up Log Rotation, that disk will fill up again in a month.



As a quick fix, set your binary logs to expire automatically. In MySQL 8.0, run this inside the SQL prompt:



SET GLOBAL binlog_expire_logs_seconds = 259200; -- 3 Days



Now, go grab a coffee. You earned it.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - AWS Disk Full? Why Deleting Logs Might Kill Your Database (And How to Fix It)
id: 978182a5-1c75-4d9a-97ad-79dd01de9695
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "AWS Disk Full? Why Deleting Lo" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("AWS Disk Full Why Deleting Logs Might Ki")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*AWS Disk Full Why Deleting Logs Might Ki*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "AWS Disk Full Why Deleting Logs Might Ki"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich AWS Disk Full? Why Deleting Logs Might K.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten AWS Disk Full? Why Deleting Logs Might Kill Your Database (And How to Fix It)

Thematisch verwandte Begriffe: Disk, Full, Deleting, Logs · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoi…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag