topic Status critical: High Unmanaged disk usage on /Volume in Network Security

Status critical: High Unmanaged disk usage on /Volume

LuigiDiFronzo9542 — Wed, 30 Apr 2025 13:37:43 GMT

Hello,

I have this message in the Health Monitor, however taking a look in the partitions the most high ocuppation is used by /Var.

Please, how can I do for free some space from this partition.

I put an image with the occupation of the partitions.

Thanks

Re: Status critical: High Unmanaged disk usage on /Volume

Mark Elsen — Wed, 30 Apr 2025 16:36:46 GMT

- Have a look at these bug reports : https://bst.cloudapps.cisco.com/bugsearch?pf=prdNm&kw=High%20Unmanaged%20disk%20usage%20on&bt=custV&sb=anfr

Re: Status critical: High Unmanaged disk usage on /Volume

LuigiDiFronzo9542 — Wed, 30 Apr 2025 17:02:06 GMT

Thanks for the answer.

The space warning is related to the FMC, and this is a virtual device.

I was able to manage the space overhead on FMC by inspecting the folder /var/sf/SRU and deleting some old Sourcefire rule updates.

Thanks for the help.

Re: Status critical: High Unmanaged disk usage on /Volume

Marvin Rhoads — Wed, 30 Apr 2025 17:24:08 GMT

As you discovered, old SRUs are one common source of this issue. There are others as well, mostly fixed in more recent versions of code. Sometimes the upgrade will prevent new storage issues from occurring but will not always remove old problems.

I recommend moving to a suggested release (e.g. 7.4.2.2) if you haven't already.

Re: Status critical: High Unmanaged disk usage on /Volume

LuigiDiFronzo9542 — Wed, 21 May 2025 17:01:56 GMT

I have another files in the virtual FMC: Cisco_Firepower_SRU-AAAA-MM-DD-001-vrt.sh.REL.tar. Is it safe to delete these files, at least the old ones?

Thanks.

Re: Status critical: High Unmanaged disk usage on /Volume

Marvin Rhoads — Thu, 22 May 2025 03:25:29 GMT

@LuigiDiFronzo9542 yes, old SRU files are generally safe to delete.

Re: Status critical: High Unmanaged disk usage on /Volume

LuigiDiFronzo9542 — Thu, 22 May 2025 15:57:35 GMT

Thanks Marvin,

In the case of old SRU, trying to delete the old files I received the message "rm: remove write-protected regular file 'Cisco_Firepower_SRU-2020-02-25-001-vrt.sh.REL.tar'?".

It's still safe to delete the files?

By other way, in the directory /var/sf/cloud_download/ are many other files of this:

-. "full_bcdb_rep_new_9.124.bin" and "part_bcdb_rep_new_9.124.bin", I understand that these old files can also be deleted, is that correct?

Many thanks.

Re: Status critical: High Unmanaged disk usage on /Volume

Marvin Rhoads — Thu, 22 May 2025 16:06:53 GMT

File removal should be done (carefully!) as root user.

I am not familiar with the bin files you mentioned.

In case of doubt, open a TAC case. Also, always be certain that you have a backup before commencing any such activity.