topic I've just tried another in Network Security

FirePOWER Backup Job fails

ammann9113 — Sun, 10 Mar 2019 13:43:50 GMT

Hello everyone

I've scheduled a backup job to run weekly. For that I created a backup profile is pretty much straight forward (see the attached screenshot).

Unfortunately this does not work. The only thing the job does is running into an "Backup died unexpectatly" error after a few seconds.

I did not find any more clues and since the configuration is quite simple, I really don't now where to go from here.

Any ideas?

Thanks!

PS: I'm running 6.1

Can you post the output of

Oliver Kaiser — Tue, 06 Dec 2016 23:14:45 GMT

Can you post the output of the following command to verify why your backup is failing (make sure to run a backup before!)

admin@firesight:~$ cat /var/log/messages | grep backup

I've just tried another

ammann9113 — Wed, 07 Dec 2016 06:55:59 GMT

I've just tried another backup. Below the result.

Edit: It does not matter if I "Email when complete" or not

Edit2: I've updated to the latest (6.1.0.1 I think) version. No change in the matter

Dec 7 06:48:46 firepower sudo:      www : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/mv /var/tmp/backupG0i0/files_not_to_tar /var/tmp/backupOSB8/files_not_to_tar
Dec 7 06:48:46 firepower sudo:      www : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/mv /var/tmp/backupG0i0/files_to_tar /var/tmp/backupOSB8/files_to_tar
Dec 7 06:48:46 firepower sudo:      www : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/sf-backup.pl /var/sf/backup/TEST.tar.gz
Dec 7 06:49:00 firepower sf-backup[27357]: Backup died unexpectedly
Dec 7 06:49:05 firepower sf-backup[27357]: Exiting... (1)

I tried reproducing it but

Oliver Kaiser — Wed, 07 Dec 2016 10:40:38 GMT

I tried reproducing it but had no success so far. I would have hoped there would be more logging output, but unfortunetly the error message is too generic.

The only issues I could think of would be resource usage related. Can you post the results of the following commands:

root@firesight:/Volume/home/admin# free -m -t

root@firesight:/Volume/home/admin# df -h

root@firesight:/Volume/home/admin# iostat

You will probably need a TAC case to resolve this, but lets verify the utilization before that.

I attached a textfile with

ammann9113 — Wed, 07 Dec 2016 10:54:38 GMT

I attached a textfile with the output.

Unfortunately I do not have a service contract for the device since it's just my homelab playground...

At some point the only thing to do will be to reset everything and start from scratch. Do you have any other ideas before I'll have to do that?

You have provisioned 2GB

Oliver Kaiser — Wed, 07 Dec 2016 11:00:47 GMT

You have provisioned 2GB memory. Your FMC already started swapping, so that might be the issue. A minimum of 8GB is recommended to run virtual FMC... Try adding more memory and try the backup again.

Well, sounds reasonable. But.

ammann9113 — Wed, 07 Dec 2016 11:47:25 GMT

Well, sounds reasonable. But...

I've got a 5506-X. I did not expect that I have to reallocate memory? I did see the high memory usage of the firepower module but I thought, since it all is in one box, it has to be right...

I thought you were running

Oliver Kaiser — Wed, 07 Dec 2016 11:50:45 GMT

I thought you were running firepower management center. I guess you manage firepower via asdm, correct?

in that case you cannot add additional memory. I thought you were running FMC as a virtual machine

Yes, I manage it via ASDM.

ammann9113 — Wed, 07 Dec 2016 11:56:37 GMT

Yes, I manage it via ASDM. Sorry that I did not clarify that..

The system load on the FirePOWER dashboard shows 44% memory load. The statistics at the monitoring tab shows a memory load of 77%. Pretty confusing.

Well.. what would you do? 🙂

I would recommend to re

Oliver Kaiser — Wed, 07 Dec 2016 12:03:29 GMT

I would recommend to re-install and try again. For further troubleshooting TAC / engineering would be needed IMO.

Ok, thanks!

ammann9113 — Wed, 07 Dec 2016 12:10:31 GMT

Ok, thanks!

One follow-up question:

ammann9113 — Wed, 07 Dec 2016 12:39:23 GMT

One follow-up question:

Is there something I have to mind regarding the reinstall? Or can I just "sw-module module sfr uninstall" and then follow the normal installation procedure?

Thanks again!

No - thats it. Uninstall the

Oliver Kaiser — Wed, 07 Dec 2016 12:41:54 GMT

No - thats it. Uninstall the sfr module and re-install. 🙂