High unmanaged disk usage on /ngfw

kurttcot — Fri, 21 Feb 2020 17:03:02 GMT

Hi, it seems this issue keeps coming back every so often. FTD 2110 HA pair running 6.2.3.10. Disk usage on node 1 is about 46% and node 2 is about 32%. I created a TAC case and Cisco is scratching their heads. All the obvious folders have been cleaned up already such as TMP, SF/Updates, etc.

The majority of the usage seems to be coming from the detection engine folders.

/ngfw/var/sf/detection_engines/9b23xxxxxxxxxxxxxxxxxxxxxxxxxxxxx11a/instance-1/
/ngfw/var/sf/detection_engines/9b23xxxxxxxxxxxxxxxxxxxxxxxxxxxxx11a/instance-2/
/ngfw/var/sf/detection_engines/9b23xxxxxxxxxxxxxxxxxxxxxxxxxxxxx11a/instance-3/

There seems to be tons of logs dating back to when the units were deployed in 2017.

fileperfstats.log.152xxxxxx
ssl-certs-unified.log.153xxxxxx
ssl-nse-debug.log.1513xxxxx
unified_events-1.log.153xxxxx
unified_stats.153xxxxx

Does anyone know whats safe to clean up in these folders? I'm not sure what should be rotated automatically and what needs to be cleaned up manually. So far, no answer from Cisco on this question so figure I would check with the community. Thanks

Re: High unmanaged disk usage on /ngfw

kurttcot — Mon, 22 Apr 2019 16:43:49 GMT

Looks like this was part of a bug.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo74833/?reffering_site=dumpcr

We fixed the error by cleaning up older logs

Re: High unmanaged disk usage on /ngfw

WangJianhu189 — Thu, 02 Apr 2020 14:02:42 GMT

Hi,frend,greetings. My firepower4120 have alarm:high unmanaged disk usage on /ngfw。Can you tell me how to go to the / NGFW directory to delete files?

topic Re: High unmanaged disk usage on /ngfw in Network Security

High unmanaged disk usage on /ngfw

Re: High unmanaged disk usage on /ngfw

Re: High unmanaged disk usage on /ngfw