ISE /opt directory is getting 100% utilized,

[ashish.saxena1]

Hello Support,

We are not getting any radious, tacacs live logs, new events.

Further checking the issue and found /opt directory is getting 100% utilized.

Tried deleting core file , resetting Mnt Database & operation data but no luck. 

Logs purging is also not working.

ISE version :- 2.6 patch 3

Model :-36xx

Internal filesystems:
/ : 16% used ( 2482716 of 16499528)
/dev : 0% used ( 0 of 16189336)
/dev/shm : 0% used ( 0 of 16201236)
/run : 1% used ( 2624 of 16201236)
/sys/fs/cgroup : 0% used ( 0 of 16201236)
/boot : 12% used ( 106784 of 991512)
/storedconfig : 2% used ( 1589 of 95054)
/boot/efi : 4% used ( 10968 of 276312)
/tmp : 1% used ( 6760 of 1983056)
/opt : 99% used ( 512276292 of 547553328)
/run/user/0 : 0% used ( 0 of 3240248)
/run/user/440 : 0% used ( 0 of 3240248)
/run/user/301 : 0% used ( 0 of 3240248)
/run/user/308 : 0% used ( 0 of 3240248)
/run/user/321 : 0% used ( 0 of 3240248)
/run/user/304 : 0% used ( 0 of 3240248)
/run/user/322 : 0% used ( 0 of 3240248)
/opt/docker/runtime/overlay/30c8ea45d2370d0b2aad038228b0f0918f2c3f0d9c91296c13c7eb01b0c40b0b/merged : 99% used ( 512276292 of 547553328)
/opt/docker/runtime/containers/b8d6267f8fa034796a4a295feaf33738dc814710deb0a4451dbc05f096430940/shm : 0% used ( 0 of 65536)
/run/user/302 : 0% used ( 0 of 3240248)
/run/user/300 : 0% used ( 0 of 3240248)
/run/user/323 : 0% used ( 0 of 3240248)
warning - /opt is 99% used (512276292 of 547553328)
warning - /opt/docker/runtime/overlay/30c8ea45d2370d0b2aad038228b0f0918f2c3f0d9c91296c13c7eb01b0c40b0b/merged is 99% used (512276292 of 547553328)

Please suggest how to resolved this issue as we dont have TAC support on this ISE.

[Flavio Miranda]

Hello,

   Unfortunatelly Ise will not allow you to fix this. If you look here on the community there are a lot of similar post with the same conclusion: You need a TAC

https://community.cisco.com/t5/network-access-control/opt-usage-is-high-on-cisco-ise-disk-policy-service-node/td-p/4731813 

https://community.cisco.com/t5/network-access-control/cisco-ise-2-2-sufficient-disk-space/td-p/3921051 

[Damien Miller · Accepted solution]

Since you don't have TAC your options are going to be severely limited. 
First check your /localdisk and see if you can delete any files in there. 

If you are on a VM, then you could follow an unsupported method and do some digging yourself like Arne described in this post. He mounted the ISE VM disk to another VM and this allows you to evaluate where the space is being used up without TAC. 
https://community.cisco.com/t5/network-access-control/ise-disk-space/m-p/3992408/highlight/true#M455269

Another option is to wipe the node, reinstall it from the ISO, and join it to the deployment again, do that for the other one too (assuming there are two).