ISE disk utilization

[Konev6990]

Good day!

I've issue with my Cisco ISE. Disk space was exhausted by 100 % 

I had erase old patches and now disk space is free. But i'm sure that some trash files also exist in my ISE. Which are could be delete from disk and why? Which files are more critical and couldn't be erased ?

 dir disk:/ rec

Directory of disk:/

       1216 Dec 27 2017 12:15:47  CmdTool.log
     126942 Dec 27 2017 12:15:47  MegaSAS.log
 2079452706 Dec 27 2017 12:44:13  test-CFG10-171227-1233.tar.gpg
  857975062 Dec 27 2017 13:28:31  logs-OPS10-171227-1326.tar.gpg
          0 Jun 07 2018 16:12:47  prrt-server.log
  470139656 Jan 13 2018 01:05:23  ise-patchbundle-2.2.0.470-Patch5-225829.SPA.x86_64.tar.gz
  474075920 Mar 12 2018 19:00:01  ise-patchbundle-2.2.0.470-Patch6-232642.SPA.x86_64.tar.gz
       5186 Dec 27 2017 12:19:54  RootKey-appbundle-1.0-x86_64.tar.gz
        317 Aug 18 2019 11:12:06  &1
     178122 Dec 26 2017 15:42:21  \\10.10.10.100\1\tech.txt
      16384 Nov 28 2017 11:32:13  lost+found/
       4096 Jun 07 2018 16:12:47  config/
       4096 Sep 23 2019 15:04:09  corefiles/

Directory of disk:/lost+found

No files in directory

Directory of disk:/config

       1208 Jun 07 2018 16:12:47  RuntimeDebugLog.config

Directory of disk:/corefiles

10320667496 Jul 29 2019 17:43:53  core.20323
      46759 Jul 29 2019 19:01:01  hs_err_pid20323.log.gz

[Surendra]

Seems like your ISE server crashed on 29th of July. Did you get that checked with TAC ? If yes, you can remove the file core.20323 and all the following files :

1216 Dec 27 2017 12:15:47 CmdTool.log
126942 Dec 27 2017 12:15:47 MegaSAS.log
2079452706 Dec 27 2017 12:44:13 test-CFG10-171227-1233.tar.gpg
857975062 Dec 27 2017 13:28:31 logs-OPS10-171227-1326.tar.gpg
0 Jun 07 2018 16:12:47 prrt-server.log
470139656 Jan 13 2018 01:05:23 ise-patchbundle-2.2.0.470-Patch5-225829.SPA.x86_64.tar.gz
474075920 Mar 12 2018 19:00:01 ise-patchbundle-2.2.0.470-Patch6-232642.SPA.x86_64.tar.gz
5186 Dec 27 2017 12:19:54 RootKey-appbundle-1.0-x86_64.tar.gz
317 Aug 18 2019 11:12:06 &1
178122 Dec 26 2017 15:42:21 \\10.10.10.100\1\tech.txt

[Colby LeMaire]

You can remove everything from the localdisk if you don't need it anymore.  Even coredumps will happen during normal operation and those files can be removed as well unless the "crash" actually caused some symptoms that the users experienced.  I have seen many ISE deployments where coredumps happen every so often but don't result in impact to operations.

[Damien Miller · Accepted solution]

You may also want to double check the output of the "show disks" command. The localdisk you are looking at is only 15 or 30 GB of the provisioned space depending on the ISE release. It is preallocated under the covers, so while you will still get an alarm if /localdisk is full, it wouldn't free up space in /opt if that was the culprit.