CSCvo74833 - High unmanaged disk space on Firepower devices due to untracked files - 1

[WangJianhu189]

My firepower4120   have alarm:high unmanaged disk usage on /ngfw。Can anyone tell me how to go to the / NGFW directory to delete files?

FPWR2-A# connect module 1 console
Telnet escape character is '~'.
Trying 127.5.1.1...
Connected to 127.5.1.1.
Escape character is '~'.

CISCO Serial Over LAN:
Close Network Connection to Exit

>
>
>
> show disk
Filesystem Size Used Avail Use% Mounted on
tmpfs 64G 1.8M 64G 1% /run
tmpfs 64G 1.6M 64G 1% /var/volatile
none 51G 1.8G 50G 4% /dev
/dev/sda1 7.5G 94M 7.4G 2% /mnt/boot
/dev/sda2 1.9G 36M 1.8G 2% /opt/cisco/config
/dev/sda3 4.6G 146M 4.3G 4% /opt/cisco/platform/logs
/dev/sda5 46G 181M 44G 1% /var/data/cores
/dev/sda6 126G 124G 2.7G 98% /ngfw
cgroup_root 64G 0 64G 0% /dev/cgroups

>

[balaji.bandi]

/dev/sda6 126G 124G 2.7G 98% /ngfw

This was 98%, you can clear unwanted Logs offloading to outside, or you can delete.

if you are not sure, then contact TAC can able to help you.

[WangJianhu189]

I want to delete some files, but I dont't know how to go to the / NGFW directory.Can you tell me the detail step?Thanks

[balaji.bandi]

Look at the document and modes :

https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/using_the_FTD_CLI.html#wp3783114587

[WangJianhu189]

Hi,friend.Thanks.

Now I read the website,and I know need to use Export mode to delete file.

When I login in export mode to delete file, the user "admin"  don't have pemission. 

I think need to use "root" to delete files.

What is the passward for root ?I use admin passward ,it can not login.

"rm: cannot remove '/ngfw/var/sf/detection_engines/a85fda0e-f93b-11e7-a24e-99ce7....../instance-9/fileperfstats.log.1585758300': Permission denied
rm: cannot remove '/ngfw/var/sf/detection_engines/a85fda0e-f93b-11e7-a24e-99ce7....../instance-9/fileperfstats.log.1585845000': Permission denied
rm: cannot remove '/ngfw/var/sf/detection_engines/a85fda0e-f93b-11e7-a24e-99ce7....../instance-9/fileperfstats.log.1585931700': Permission denied"

admin@Firepower-module1:/$ sudo du -
Password:
Password:
Sorry, try again.
Password:
Password:
Sorry, try again.
Password:
Password:
Sorry, try again.
sudo: 3 incorrect password attempts
admin@Firepower-module1:/$

[balaji.bandi]

sudo su - ( not sudo du -)

[WangJianhu189]

hI,Friend

[WangJianhu189]

Hi,friend . 

[WangJianhu189]

I have the passward now,then I delete some files,but still disk usage is high, just form 98% down to 94%
root@Firepower-module1:~# df -h
Filesystem Size Used Avail Use% Mounted on
tmpfs 64G 1.8M 64G 1% /run
tmpfs 64G 1.6M 64G 1% /var/volatile
none 51G 1.8G 50G 4% /dev
/dev/sda1 7.5G 94M 7.4G 2% /mnt/boot
/dev/sda2 1.9G 36M 1.8G 2% /opt/cisco/config
/dev/sda3 4.6G 146M 4.3G 4% /opt/cisco/platform/logs
/dev/sda5 46G 181M 44G 1% /var/data/cores
/dev/sda6 126G 124G 2.7G 98% /ngfw
cgroup_root 64G 0 64G 0% /dev/cgroups
root@Firepower-module1:~# show version
-su: show: command not found
root@Firepower-module1:~# cd /ngfw/var/sf/detection_engines/
root@Firepower-module1:/ngfw/var/sf/detection_engines# ls
97a4199a-5779-11e8-a1c7-3e5fb18a28eb
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf /ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/fileperfstats.log.*
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/ssl-certs-unified.log.*
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf /ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/ssl-nse-debug.log.*
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf /ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/ssl-stats-unified.log.*
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf /ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/rna-201*
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf /ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/2018*
root@Firepower-module1:/ngfw/var/sf/detection_engines# rm -rf /ngfw/var/sf/detection_engines/97a4199a-5779-11e8-a1c7-3e5fb18a28eb/instance-*/2019*
root@Firepower-module1:/ngfw/var/sf/detection_engines# df -h
Filesystem Size Used Avail Use% Mounted on
tmpfs 64G 1.8M 64G 1% /run
tmpfs 64G 1.6M 64G 1% /var/volatile
none 51G 1.8G 50G 4% /dev
/dev/sda1 7.5G 94M 7.4G 2% /mnt/boot
/dev/sda2 1.9G 36M 1.8G 2% /opt/cisco/config
/dev/sda3 4.6G 147M 4.3G 4% /opt/cisco/platform/logs
/dev/sda5 46G 181M 44G 1% /var/data/cores
/dev/sda6 126G 118G 7.7G 94% /ngfw
cgroup_root 64G 0 64G 0% /dev/cgroups
root@Firepower-module1:/ngfw/var/sf/detection_engines#
root@Firepower-module1:/ngfw/var/sf/detection_engines#
root@Firepower-module1:/ngfw/var/sf/detection_engines#
root@Firepower-module1:/ngfw/var/sf/detection_engines#

[balaji.bandi]

is this resolve or you having still issue, have you get chance to open a TAC case ?