cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


259
Views
5
Helpful
3
Replies
Beginner

Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

Hi,

Currently facing a disk utilization issue on FMC1500 at a client.  Clearing old updates, patches, and log files, recovered about 10GB but the /var partition is full again causing FMC GUI to stop working.

 

Checking disk usage, the "sfsnort" directory is 200GB+.  Total /var partition is 280GB.

 

Any ideas how to reduce the size of this directory?


Thanks,

 

mag

Everyone's tags (1)
3 REPLIES 3
Highlighted
Hall of Fame Guru

Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

I always recommend a TAC case when modifying the directories within an FMC. It is very easy to make the system have an unrecoverable error if you do something wrong.

Beginner

Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

Resolved!

 

Opened a Cisco TAC case as suggested by @Marvin Rhoads 

TAC engineer removed a bunch of files, name containing "packet_log",  from the sfsnort directory.

Brought down disk utilization very significantly and all is well now.

Apparently these were very old files.

 

Hall of Fame Guru

Re: Firepower Management Centre - Sourcefire Snort directory size (200GB+)!

Thanks for sharing your solution.

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here