asa 5506-x , firepower /var is almost full

[dm]

Hello!

There are no backups, no old updates:

/dev/vda7 38G 35G 675M 99% /var

What can I remove to clean up some space?

Thank you!

[nspasov]

What version of software are you running?

Thank you for rating helpful posts!

[dm]

6.2.3.14

[nspasov]

Hmm, I was not able to find any defects associated with this behavior. I would recommend reaching out to Cisco TAC for further troubleshooting. Let us know what the outcome/resolution is!

Thank you for rating helpful posts!

[dm]

Well, looks like most  of used space is

sudo du -sh /var/sf/SRU
21G /var/sf/SRU

/var/sf/SRU$ ls
Sourcefire_Rule_Update-2017-09-13-001-vrt.sh
Sourcefire_Rule_Update-2018-08-23-001-vrt.1535437652.info
Sourcefire_Rule_Update-2018-08-23-001-vrt.1535437652.lsm

etc..

Can I delete old files?

Thank you!

[Marvin Rhoads]

Generally speaking you can remove old SRU files. However, I'd still follow @nspasov 's advice and only do so with TAC assistance. (Unless it's just a lab and you wouldn't be doing anything service-affecting if you accidentally brick the device!)

[dm]

"Generally speaking you can remove old SRU files."

OK, thank you! So, here is problem- firepower for some reason do not remove old files, this is, definitely, bug.

"brick the device"  firepower in asa 5506-x is VM, it is impossible to brick VM, it is always possible to install it again...

[Marvin Rhoads]

There are many, many ASA 5506's with Firepower service moduels that do delete the old SRU files. Yours may indeed be encountering a defect but no published defect causes that as first glance. It would be something the TAC could confirm and they can file a new defect report if that's the case.

While one can certainly re-install a Firepower service module, doing so renders the current installation completely gone so I would say that's the software equivalent of "bricking" a hardware appliance.

[dm]

Marvin, well, ok.

Thank you.