Disk space issue in Firepower 9300 module

[Chess Norris]

I just starting to get disk space alarms from FMC about one of our firepower 9300 modules running version 6.2.3

I can see that there is two specific folders called detection_engines that can be found under /ngfw/var/sf/ and under /ngfw/volume/6.2.3/sf/  

Those folders are about 40 Gig each and contain sub folders named instance-1, Instance-2, etc. and each of those folders contain thousands of files with names like unified_events-1.log and unified_stats.1533299968.

Anyone know what those files are and what can be removed? I tried to do a cat on one of the log files, but they seam to be binary files.

Thanks in advance

/Jörgen

[matty-boy]

Hello,

This could be related to an issue I've seen in the past where the disk manager process stops and needs to be restarted.
For us, there was no easy, permanent fix, just the workaround below. We don’t know why the issue only affects one 2140 but it does. Apparently it's a known bug and is fixed in version 6.3.

The process that works for us is as follows:-

1. SSH to the firewall
2. Go into expert mode
3. Make a note of the current disk usage of the /ngfw directory:
firepower:/$ df -h /ngfw
4. Restart the diskmanager process:
firepower:/$ sudo pmtool restartbyid diskmanager (enter the password if prompted)
5. Wait a few minutes, then check the disk usage of the /ngfw directory again:
firepower:/$ df -h /ngfw

You should notice the disk usage is now reduced.
The alarm in the FMC should disappear after a short while.

Hope this helps,
Matt.

[Chess Norris]

Thank you for the reply.  I will try restarting the disk manager. Do you happen to have the bug id for this issue?

Thanks

/Jörgen

[matty-boy]

The TAC engineer we worked with pointed us at this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz28594

Although that doesn't appear to mention the workaround that TAC provided to us directly.

HTH,

Matt.