topic FMC "mongo terminated unexpected" notification and it be disk full in Network Security

FMC "mongo terminated unexpected" notification and it be disk full

hamidreza.taghipur — Tue, 26 Mar 2024 07:54:46 GMT

i use FMC 6.4.0.4 (vm ) for 2 FTD Cluster (6.2.3) afew days ago i took some alarm in fmc "mongo terminated unexpected " and i recognized it be create file every 5 minutes in /var/opt/lamplighter/data/journal/ that cause my FMC disk be full . at last these files cause my FMC disk be full and i cannot login to fmc . and i have to remove these logs with CLI every day so that disk will be not full. if you have any solution for solving that please tell me . if not , i thinnk i have to move to my last clone of FMC .

1-i have a clone of this FMC but it is for 5 month ago and it is not diffrent with this FMC version insted of some Access control rules and some SRU/VDB update , can i use it ? i mean i turn off this FMC and turn on that ?

2-in this FMC i have backup (system > tools >backup) and take export config file (system > tools > export ) ... if i use my old FMC (Clone ) can i use these backup (export and configuration) configuration ? i have many rules in my Access Control Policy that After changing FMC , they should not change do you have the better solution for my problem ?

thanks

Re: FMC "mongo terminated unexpected" notification and it be

Mark Elsen — Tue, 26 Mar 2024 12:41:52 GMT

- Check content of /var/log/mongodb/mongod.log

Re: FMC "mongo terminated unexpected" notification and it be

Marvin Rhoads — Tue, 26 Mar 2024 14:52:13 GMT

You can only restore an old FMC backup onto a system with the same version and VDB. If you meet those requirements, you should be able to use the clone.

In the longer term you should really plan to get on to a current supported version. You are running many releases behind what is current and supported.

Re: FMC "mongo terminated unexpected" notification and it be

hamidreza.taghipur — Wed, 27 Mar 2024 05:58:36 GMT

thanks marce , but i didnt have mongodb directory in /var/log .

Re: FMC "mongo terminated unexpected" notification and it be

hamidreza.taghipur — Wed, 27 Mar 2024 06:24:19 GMT

you are right
i must switch to high version of FTD and FMC . unfortunately we didnt have higher version of ESXI . after upgrade them we will switch to current supported version of FTD
i dont sure of old clone vdb version , what happen if i start old clone with diffrent vdb version ?
if i will start old clone (FMC) , how i restore my ACP policy ( because i had many new rules after clone and i have exported ACPs of latest FMC ) ? can i import from system > tools > import , is it true ?

Re: FMC "mongo terminated unexpected" notification and it be

Marvin Rhoads — Wed, 27 Mar 2024 14:38:45 GMT

You can export your ACP from the failing FMC and import into the clone if they are the same FMC version.