09-05-2005 05:05 AM - edited 03-10-2019 01:37 AM
When I go to apply the update, I get the following error:
Broadcast message from root (Mon Sep 5 02:27:23 2005):
Applying update IDS-K9-sp-4.1-5-S189.
Shutting down all CIDS processes. All connections will be terminated.
The system will be rebooted upon completion of the update.
Error: The update requires KB in /usr/cids/idsRoot, there are only 23952 KB available.
Here's how much memory I have available:
Using 184365056 out of 1980493824 bytes of available memory (9% usage)
Using 4.4G out of 15G bytes of available disk space (31% usage)
I was recently having problems with memory just applying the signature updates on other sensors. The 4.1(h) patch fixed that. On this particular sensor, I ran the S189 update, got errors, installed the 4.1(h) patch which "freed" more memory, but I still get the same error.
Any ideas? Is there anything I can delete on the /usr/cids/idsRoot partition?
09-05-2005 08:21 AM
This upgrade is not failing because of a memory issue but due to a lack of free disk space.
From your "show ver", it looks like you still have plenty of space but that may be misleading.
Could you post the output of "df -k" captured from the service account?
Thanks,
JF
09-06-2005 03:00 AM
Here's a df:
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/sda1 648256 590976 24352 97% /
none 967036 0 967036 0% /dev/shm
/dev/sda6 7746 1044 6302 15% /usr/cids/idsRoot/shared
/dev/sda2 15812524 4520588 10488688 31% /usr/cids/idsRoot/var
There is hardly anything taking up space in /var/log also. Where else are there typically large files that I can delete?
09-05-2005 11:18 AM
As jdal suggested, the df -k will show how much space is left on the disk. The partition you need to look at is the root partion ("/" under the "Mounted on" column heading). This 4.1(5) package requires 25 Meg of free space in the root partition. If you need to free up space then look at the syslog area (/var/log) and at the service account home directory (sometimes people store files there). The disk space data that shows in the "show ver" is the /usr/cids/idsRoot/var partition.
09-05-2005 04:44 PM
I've successfully installed the following in sequence: 4.1(4h) -> 4.1(4)S187 -> 4.1(5)S189
*****
Application Partition:
Cisco Systems Intrusion Detection Sensor, Version 4.1(5)S189
OS Version 2.4.18-5smpbigphys
Platform: IDS-4250-XL
Sensor up-time is 3:05.
Using 244011008 out of 1980493824 bytes of available memory (12% usage)
Using 583M out of 15G bytes of available disk space (4% usage)
MainApp 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
AnalysisEngine 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
Authentication 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
Logger 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
NetworkAccess 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
TransactionSource 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
WebServer 2005_Sep_01_21.30 (Release) 2005-09-01T21:30:35-0500 Running
CLI 2005_Aug_02_10.53 (Release) 2005-08-02T10:25:35-0500
Upgrade History:
* IDS-sig-4.1-4-S187 14:11:02 UTC Tue Sep 06 2005
IDS-K9-sp-4.1-5-S189.rpm.pkg 14:16:08 UTC Tue Sep 06 2005
Recovery Partition Version 1.2 - 4.1(1)S47
qsensor-24#
*****
Obviously my sensor didn't have much disk space utilized. Try deleting unneeded logs to free up disk space.
09-06-2005 03:03 AM
Yes, the root ("/") is huge. Here's a df:
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/sda1 648256 590976 24352 97% /
none 967036 0 967036 0% /dev/shm
/dev/sda6 7746 1044 6302 15% /usr/cids/idsRoot/shared
/dev/sda2 15812524 4520588 10488688 31% /usr/cids/idsRoot/var
There is hardly anything taking up space in /var/log, but I deleted some files which left me with the space (captured above). Also, I didn't see anything at all in the user accounts. Where else are large files typically stored?
09-06-2005 06:55 AM
You can narrow down what directory is consuming the majority of the disk space by issuing the following commands as root in the service account (please respond with the output):
du -hs /*
and then
du -hs /usr/cids/idsRoot/*
09-06-2005 06:57 AM
The 97% usage on /dev/sda1 648256 590976 24352 97% /
needs to be reduced as much as possible.
from / can you e-mail me the output of ls -ltr * >
Also, let's see how many files are under / (ls -l * | wc -l). Sould be not much more than around 6040.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: