cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
261
Views
0
Helpful
7
Replies
Beginner

Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

When I go to apply the update, I get the following error:

Broadcast message from root (Mon Sep 5 02:27:23 2005):

Applying update IDS-K9-sp-4.1-5-S189.

Shutting down all CIDS processes. All connections will be terminated.

The system will be rebooted upon completion of the update.

Error: The update requires KB in /usr/cids/idsRoot, there are only 23952 KB available.

Here's how much memory I have available:

Using 184365056 out of 1980493824 bytes of available memory (9% usage)

Using 4.4G out of 15G bytes of available disk space (31% usage)

I was recently having problems with memory just applying the signature updates on other sensors. The 4.1(h) patch fixed that. On this particular sensor, I ran the S189 update, got errors, installed the 4.1(h) patch which "freed" more memory, but I still get the same error.

Any ideas? Is there anything I can delete on the /usr/cids/idsRoot partition?

7 REPLIES 7
Highlighted
Cisco Employee

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

This upgrade is not failing because of a memory issue but due to a lack of free disk space.

From your "show ver", it looks like you still have plenty of space but that may be misleading.

Could you post the output of "df -k" captured from the service account?

Thanks,

JF

Beginner

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

Here's a df:

Filesystem 1k-blocks Used Available Use% Mounted on

/dev/sda1 648256 590976 24352 97% /

none 967036 0 967036 0% /dev/shm

/dev/sda6 7746 1044 6302 15% /usr/cids/idsRoot/shared

/dev/sda2 15812524 4520588 10488688 31% /usr/cids/idsRoot/var

There is hardly anything taking up space in /var/log also. Where else are there typically large files that I can delete?

Cisco Employee

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

As jdal suggested, the df -k will show how much space is left on the disk. The partition you need to look at is the root partion ("/" under the "Mounted on" column heading). This 4.1(5) package requires 25 Meg of free space in the root partition. If you need to free up space then look at the syslog area (/var/log) and at the service account home directory (sometimes people store files there). The disk space data that shows in the "show ver" is the /usr/cids/idsRoot/var partition.

Beginner

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

I've successfully installed the following in sequence: 4.1(4h) -> 4.1(4)S187 -> 4.1(5)S189

*****

Application Partition:

Cisco Systems Intrusion Detection Sensor, Version 4.1(5)S189

OS Version 2.4.18-5smpbigphys

Platform: IDS-4250-XL

Sensor up-time is 3:05.

Using 244011008 out of 1980493824 bytes of available memory (12% usage)

Using 583M out of 15G bytes of available disk space (4% usage)

MainApp 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

AnalysisEngine 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

Authentication 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

Logger 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

NetworkAccess 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

TransactionSource 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

WebServer 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running

CLI 2005_Aug_02_10.53 (Release) 2005-08-02T10:25:35-0500

Upgrade History:

* IDS-sig-4.1-4-S187 14:11:02 UTC Tue Sep 06 2005

IDS-K9-sp-4.1-5-S189.rpm.pkg 14:16:08 UTC Tue Sep 06 2005

Recovery Partition Version 1.2 - 4.1(1)S47

qsensor-24#

*****

Obviously my sensor didn't have much disk space utilized. Try deleting unneeded logs to free up disk space.

Beginner

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

Yes, the root ("/") is huge. Here's a df:

Filesystem 1k-blocks Used Available Use% Mounted on

/dev/sda1 648256 590976 24352 97% /

none 967036 0 967036 0% /dev/shm

/dev/sda6 7746 1044 6302 15% /usr/cids/idsRoot/shared

/dev/sda2 15812524 4520588 10488688 31% /usr/cids/idsRoot/var

There is hardly anything taking up space in /var/log, but I deleted some files which left me with the space (captured above). Also, I didn't see anything at all in the user accounts. Where else are large files typically stored?

Cisco Employee

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

You can narrow down what directory is consuming the majority of the disk space by issuing the following commands as root in the service account (please respond with the output):

du -hs /*

and then

du -hs /usr/cids/idsRoot/*

Beginner

Re: Failure applying S189 to a 4.1(4)S187 IDS on a IDS-4250-XL

The 97% usage on /dev/sda1 648256 590976 24352 97% /

needs to be reduced as much as possible.

from / can you e-mail me the output of ls -ltr * >

Also, let's see how many files are under / (ls -l * | wc -l). Sould be not much more than around 6040.

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards