topic Re: Firepower boot disk full in Network Security

Firepower boot disk full

HimeshGohil — Wed, 18 Aug 2021 12:07:58 GMT

Hi, we've been having issue with one of our Firepower modules.

I've tracked the issue down to the /boot disk being full.

Here's a listing of the files;

root@Firepower:/boot# ls -lah
total 51M
drwxr-xr-x 6 root root 1.0K Sep 3 2015 .
drwxr-xr-x 22 root root 4.0K Feb 27 2017 ..
lrwxrwxrwx 1 root root 32 Sep 5 2015 System.map -> System.map-2.6.32.24-sf.cisco-10
-rw-r--r-- 1 root root 2.3M Sep 5 2015 System.map-2.6.32.24-sf.cisco-10
-rw-r--r-- 1 root root 2.3M May 15 2015 System.map-2.6.32.24-sf.cisco-45
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-47
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-49
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-51
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-9
drwxr-xr-x 2 root root 1.0K May 15 2015 boot
-rw-r--r-- 1 root root 512 May 15 2015 boot.0800
-rw-r--r-- 1 root root 3.6M Sep 5 2015 bzImage-2.6.32.24-sf.cisco-10
-rw-r--r-- 1 root root 3.7M May 15 2015 bzImage-2.6.32.24-sf.cisco-45
-rw-r--r-- 1 root root 3.7M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-47
-rw-r--r-- 1 root root 3.7M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-49
-rw-r--r-- 1 root root 3.7M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-51
-rw-r--r-- 1 root root 3.6M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-9
-rw-r--r-- 1 root root 5.0K Mar 30 2015 diag1.img
drwxr-xr-x 2 root root 1.0K May 15 2015 grub
-rw-r--r-- 1 root root 2.5M Sep 5 2015 initrd-2.6.32.24-sf.cisco-10
-rw-r--r-- 1 root root 2.4M May 15 2015 initrd-2.6.32.24-sf.cisco-45
-rw-r--r-- 1 root root 2.4M Aug 20 2015 initrd-2.6.32.24-sf.cisco-47
-rw-r--r-- 1 root root 2.4M Aug 20 2015 initrd-2.6.32.24-sf.cisco-49
-rw-r--r-- 1 root root 2.4M Aug 20 2015 initrd-2.6.32.24-sf.cisco-51
-rw-r--r-- 1 root root 2.5M Aug 20 2015 initrd-2.6.32.24-sf.cisco-9
drwxr-xr-x 2 root root 1.0K Feb 27 2017 kernels
drwx------ 2 root root 12K May 15 2015 lost+found
-rw------- 1 root root 89K Sep 5 2015 map
-rw------- 1 root root 0 Feb 27 2017 map~

/boot/kernel is also big, here's a listing of that dir

root@Firepower:/boot/kernels# ls -lah
total 37M
drwxr-xr-x 2 root root 1.0K Feb 27 2017 .
drwxr-xr-x 6 root root 1.0K Sep 3 2015 ..
-rw-r--r-- 1 root root 2.3M Sep 5 2015 System.map-2.6.32.24-sf.cisco-10
-rw-r--r-- 1 root root 2.3M May 15 2015 System.map-2.6.32.24-sf.cisco-45
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-47
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-49
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-51
-rw-r--r-- 1 root root 2.3M Aug 20 2015 System.map-2.6.32.24-sf.cisco-9
-rw-r--r-- 1 root root 3.6M Sep 5 2015 bzImage-2.6.32.24-sf.cisco-10
-rw-r--r-- 1 root root 1008K Sep 5 2015 bzImage-2.6.32.24-sf.cisco-15
-rw-r--r-- 1 root root 0 Feb 27 2017 bzImage-2.6.32.24-sf.cisco-16
-rw-r--r-- 1 root root 0 Feb 27 2017 bzImage-2.6.32.24-sf.cisco-17
-rw-r--r-- 1 root root 3.7M May 15 2015 bzImage-2.6.32.24-sf.cisco-45
-rw-r--r-- 1 root root 3.7M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-47
-rw-r--r-- 1 root root 3.7M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-49
-rw-r--r-- 1 root root 3.7M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-51
-rw-r--r-- 1 root root 3.6M Aug 20 2015 bzImage-2.6.32.24-sf.cisco-9

I've compared these with a good and working Firepower module and I can see two files of type;

System.map

bzImange

inird

I guess the other files are surplus

How should it determine and remove the surplus files (assuming this is my issue).

FP is on version 5.4

We did have somebody try to upgrade the module some time ago and this could be the result of a failed upgrade?

Thanks

Re: Firepower boot disk full

Marvin Rhoads — Wed, 18 Aug 2021 12:13:05 GMT

Is this a Firepower service module on an ASA? If so, i would just reimage it and start fresh with something more current. 5.4 was the initial release of Firepower on ASA from back in 2015 and it's way past end of support by now.

Re: Firepower boot disk full

HimeshGohil — Wed, 18 Aug 2021 12:18:38 GMT

Thanks.

Yes on an ASA

I was hoping to clean it up and upgrade it properly as we have three other ASA's and they all need upgrading (both the ASA and FP software).

Fixing this FP module is the first part of the upgrade plan.

I'll wait to see if anybody else has any ideas, otherwise I'll have to go with your suggestion and re-image.

Maybe it's worth re-imaging them all with the latest supported version of FP for my level of ASA?

Re: Firepower boot disk full

balaji.bandi — Wed, 18 Aug 2021 12:27:19 GMT

agree with @Marvin Rhoads, re-image is easy task for you, since upgrade rquirement is basic disk capacity to clean up, but deleting some unknow fails may cause different issue, instead - re-image can give you new stable version.

Maybe it's worth re-imaging them all with the latest supported version of FP for my level of ASA?

if i were you i will take this route and learn the lessons and re-image others as you looking more FP to re-image.

Re: Firepower boot disk full

Marvin Rhoads — Wed, 18 Aug 2021 12:29:12 GMT

Upgrading from 5.4 to anything near current (6.2.3 for older ASAs and 6.6.4 for newer ones) requires MANY sequential upgrades. It would literally take several days IF everything goes well.

A reimage takes an hour or two.

Re: Firepower boot disk full

HimeshGohil — Wed, 18 Aug 2021 12:34:47 GMT

Thanks both.

I've been researching re-imaging in any case as I thought that's what I'd need to do to recover my module. The disk full and your comments confirms this.

I'll have some other questions on re-imaging as I've not worked on these systems much and I'll ask them in a separate post