CSCvt77813 - High unmanaged disk usage on /ngfw

[dwillia5@highpoint.edu]

This apparently is still not fixed in 7.0.1

I have an open TAC case for it, here is the output of ls -larsht from /var/sf/cloud_download

root@firepower:/var/sf/cloud_download# ls -larsht
total 11G
8.0K -rw-r--r-- 1 www www 5.5K Sep 16 2020 threat_categories.json
24K -rw-r--r-- 1 www www 23K Sep 16 2020 aup_categories.json
8.0K -rw-r--r-- 1 root root 4.4K Oct 27 2020 rules_1597771256
8.0K -rw-r--r-- 1 root root 4.4K Oct 29 2020 rules_1604013865
8.0K -rw-r--r-- 1 root root 4.4K Oct 30 2020 rules_1604029100
8.0K -rw-r--r-- 1 root root 4.4K Feb 15 2021 rules_1613405545
8.0K -rw-r--r-- 1 root root 4.4K Apr 12 2021 rules_1618216030
8.0K -rw-r--r-- 1 root root 4.5K Jun 7 2021 rules_1623064842
8.0K -rw-r--r-- 1 root root 4.5K Jul 7 2021 rules_1625666389
4.0K -rw-r--r-- 1 www www 1008 Oct 5 03:24 sfrep_index
20K -rw-r--r-- 1 www www 20K Oct 5 03:24 brightcloud_to_beaker_id_mapping.json
4.0K -rw-r--r-- 1 www www 3.1K Oct 5 03:24 brightcloud_categories.json
0 drwxr-xr-x 3 www www 22 Oct 5 03:30 tmp_cisco
0 drwxr-xr-x 2 www www 21 Oct 5 03:30 tmp
8.0K -rw-r--r-- 1 root root 4.5K Jan 18 13:01 rules_1642510566
8.0K -rw-r--r-- 1 root root 4.5K Feb 23 12:57 rules_1645620832
487M -rw-r--r-- 1 root root 487M Mar 15 12:11 cisco_uridb_large_1647337046
487M -rw-r--r-- 1 root root 487M Mar 16 09:45 cisco_uridb_large_1647423493
487M -rw-r--r-- 1 root root 487M Mar 17 09:45 cisco_uridb_large_1647509830
487M -rw-r--r-- 1 root root 487M Mar 18 09:40 cisco_uridb_large_1647596143
487M -rw-r--r-- 1 root root 487M Mar 19 09:41 cisco_uridb_large_1647682617
487M -rw-r--r-- 1 root root 487M Mar 20 09:53 cisco_uridb_large_1647768985
487M -rw-r--r-- 1 root root 487M Mar 21 09:42 cisco_uridb_large_1647855352
493M -rw-r--r-- 1 root root 493M Mar 22 09:41 cisco_uridb_large_1647941613
493M -rw-r--r-- 1 root root 493M Mar 23 09:46 cisco_uridb_large_1648028234
493M -rw-r--r-- 1 root root 493M Mar 24 09:46 cisco_uridb_large_1648114688
493M -rw-r--r-- 1 root root 493M Mar 25 09:45 cisco_uridb_large_1648200967
493M -rw-r--r-- 1 root root 493M Mar 26 09:42 cisco_uridb_large_1648287353
493M -rw-r--r-- 1 root root 493M Mar 27 09:43 cisco_uridb_large_1648373770
493M -rw-r--r-- 1 root root 493M Mar 28 09:46 cisco_uridb_large_1648460255
497M -rw-r--r-- 1 root root 497M Mar 29 09:41 cisco_uridb_large_1648546401
497M -rw-r--r-- 1 root root 497M Mar 30 09:42 cisco_uridb_large_1648633025
8.0K -rw-r--r-- 1 root root 4.5K Mar 30 16:46 rules_1648658565
494M -rw-r--r-- 1 root root 494M Mar 31 09:42 cisco_uridb_large_1648719196
494M -rw-r--r-- 1 root root 494M Apr 1 09:42 cisco_uridb_large_1648805768
4.0K drwxr-xr-x 72 root root 4.0K Apr 1 13:31 ..
494M -rw-r--r-- 1 root root 494M Apr 2 09:42 cisco_uridb_large_1648892128
494M -rw-r--r-- 1 root root 494M Apr 3 09:43 cisco_uridb_large_1648978535
494M -rw-r--r-- 1 root root 494M Apr 4 09:42 cisco_uridb_large_1649064914
0 drwxr-xr-x 2 www www 6 Apr 4 09:42 cisco
4.0K drwxr-xr-x 5 www www 4.0K Apr 4 09:42

We received an alert every 5 minutes yesterday.....

[cae_technology]

what did tac say? we are on 7.0.4 and see this.

thank you.

Mo

[k9aniil]

Replace the content in the following 2 files:

/ngfw/etc/logrotate.d/pm.logrotate

/ngfw/etc/logrotate-size.d/pm.logrotate

Populated both files with the following content:

/ngfw/var/log/process_std*.log {

    missingok

    compress

    copytruncate

    maxsize 1G

    rotate 4

    sharedscripts

}

Then run the commands:

logrotate -f /ngfw/etc/logrotate.d/pm.logrotate

/ngfw/etc/rc.d/init.d/syslog-ng restart