topic Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)! in Network Security

Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

magurwara — Thu, 28 Nov 2019 10:28:44 GMT

Hi,

Currently facing a disk utilization issue on FMC1500 at a client. Clearing old updates, patches, and log files, recovered about 10GB but the /var partition is full again causing FMC GUI to stop working.

Checking disk usage, the "sfsnort" directory is 200GB+. Total /var partition is 280GB.

Any ideas how to reduce the size of this directory?

Thanks,

mag

Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

Marvin Rhoads — Thu, 28 Nov 2019 11:57:48 GMT

I always recommend a TAC case when modifying the directories within an FMC. It is very easy to make the system have an unrecoverable error if you do something wrong.

Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

magurwara — Fri, 06 Dec 2019 09:38:24 GMT

Resolved!

Opened a Cisco TAC case as suggested by @Marvin Rhoads

TAC engineer removed a bunch of files, name containing "packet_log", from the sfsnort directory.

Brought down disk utilization very significantly and all is well now.

Apparently these were very old files.

Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

Marvin Rhoads — Fri, 06 Dec 2019 12:17:18 GMT

Thanks for sharing your solution.