Delete backups on FMC - 90% disk space used

[ABaker94985]

Our backups have started failing because there is too much disk space used. This is an FMC2500 running 6.6.4, and if I select more than one backup, only one backup is deleted. I've downloaded a couple key backups, so I'd like to delete them all. Is this possible, and if so, how is this done? I can't track this down through the Cisco documentation. Thanks

[balaji.bandi · Accepted solution]

check what is occupied most of the space, below guide can help you (just like any other Linux command to check the space) and delete where most not required, either take the backup of the file, if too old delete (any Logs which is not required)

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118719-technote-firesight-00.html

[rcullum]

Hi

I don't think this can be done if it's a remote storage server. I have tried on 6.6.1 and 6.6.4. If you are backing up to a remote storage server, then best bet is to login to the remote server and delete the backups there. Then your FMC view of backups available will refresh.

[Chakshu Piplani · Accepted solution]

This was tested in my lab, be very careful in executing the rm -rf command and make sure you are putting the right strings and then the * to cover what all you need to delete.

The command "rm -rf Weekly_config_only_backup_2021*" deletes anything that starts with "Weekly_config_only_backup_2021", you can change it to 2020, 2019 according to your need and prepend it to what you have on your FMC.

admin@fmc67:~$ sudo su
Password: 
root@fmc67:/Volume/home/admin# cd /var/sf/backup/
root@fmc67:/var/sf/backup# ls -la
total 6541812
drwxr-xr-x  2 www  www       4096 Jul 19 01:06 .
drwxr-xr-x 77 root root      4096 Jul 14 17:55 ..
-rw-r--r--  1 www  root 286863360 Mar 15 11:17 MyFirstCLIBackup-2021-03-15T11-11-07.tar
-rw-r--r--  1 www  root 367974400 Feb 15 02:06 Weekly_config_only_backup_20210215020002-2021-02-15T02-00-03.tar
-rw-r--r--  1 www  root 277852160 Feb 22 02:06 Weekly_config_only_backup_20210222020003-2021-02-22T02-00-04.tar
-rw-r--r--  1 www  root 283310080 Mar  1 02:06 Weekly_config_only_backup_20210301020002-2021-03-01T02-00-03.tar
-rw-r--r--  1 www  root 284682240 Mar  8 02:07 Weekly_config_only_backup_20210308020002-2021-03-08T02-00-04.tar
-rw-r--r--  1 www  root 287395840 Mar 15 01:07 Weekly_config_only_backup_20210315010003-2021-03-15T01-00-04.tar
-rw-r--r--  1 www  root 287027200 Mar 22 01:07 Weekly_config_only_backup_20210322010004-2021-03-22T01-00-05.tar
-rw-r--r--  1 www  root 290836480 Mar 29 01:09 Weekly_config_only_backup_20210329010002-2021-03-29T01-00-04.tar
-rw-r--r--  1 www  root 314992640 Apr  5 01:08 Weekly_config_only_backup_20210405010002-2021-04-05T01-00-03.tar
-rw-r--r--  1 www  root 308254720 Apr 12 01:11 Weekly_config_only_backup_20210412010003-2021-04-12T01-00-04.tar
-rw-r--r--  1 www  root 310722560 Apr 19 01:09 Weekly_config_only_backup_20210419010002-2021-04-19T01-00-03.tar
-rw-r--r--  1 www  root 372879360 Apr 26 01:07 Weekly_config_only_backup_20210426010002-2021-04-26T01-00-03.tar
-rw-r--r--  1 www  root 365004800 May  3 01:06 Weekly_config_only_backup_20210503010001-2021-05-03T01-00-02.tar
-rw-r--r--  1 www  root 370257920 May 10 01:06 Weekly_config_only_backup_20210510010002-2021-05-10T01-00-03.tar
-rw-r--r--  1 www  root 372838400 May 17 01:06 Weekly_config_only_backup_20210517010002-2021-05-17T01-00-03.tar
-rw-r--r--  1 www  root 386140160 May 24 01:06 Weekly_config_only_backup_20210524010006-2021-05-24T01-00-07.tar
-rw-r--r--  1 www  root 386600960 May 31 01:05 Weekly_config_only_backup_20210531010002-2021-05-31T01-00-03.tar
-rw-r--r--  1 www  root 376791040 Jul  5 01:06 Weekly_config_only_backup_20210705010002-2021-07-05T01-00-03.tar
-rw-r--r--  1 www  root 383365120 Jul 12 01:06 Weekly_config_only_backup_20210712010002-2021-07-12T01-00-03.tar
-rw-r--r--  1 www  root 384962560 Jul 19 01:06 Weekly_config_only_backup_20210719010002-2021-07-19T01-00-03.tar
root@fmc67:/var/sf/backup# 
root@fmc67:/var/sf/backup# 
root@fmc67:/var/sf/backup# rm -rf Weekly_config_only_backup_2021*
root@fmc67:/var/sf/backup# ls -la
total 280148
drwxr-xr-x  2 www  www       4096 Jul 19 18:23 .
drwxr-xr-x 77 root root      4096 Jul 14 17:55 ..
-rw-r--r--  1 www  root 286863360 Mar 15 11:17 MyFirstCLIBackup-2021-03-15T11-11-07.tar
root@fmc67:/var/sf/backup# 

As you can see all backup's except MyFirstCLIBackup-2021-03-15T11-11-07.tar were deleted.

Run it at your own risk.

Regards,

Chakshu

Do rate helpful posts!

[ABaker94985]

There are currently 330 backups showing up through the FMC UI. However, there is nothing in the backup folder:

root@FMC2500:/var/sf/backup# pwd
/var/sf/backup
root@FMC2500:/var/sf/backup# ls -la
total 8
drwxr-xr-x 2 www www 4096 Apr 22 03:01 .
drwxr-xr-x 77 root root 4096 Jul 14 17:55 ..
root@FMC2500:/var/sf/backup#

This was setup before starting work here, and I've been told this is using local storage. We do have a job setup that copies backups to a SFTP server, but there is plenty of storage on that device.

I'll go back through the document referenced by BB above. That seemed to be for a different platform, but I'll read through it a bit close.

[ABaker94985]

df shows the used percentage is around 53%:

root@FMC2500:/var/sf/backup# df -TH
Filesystem Type Size Used Avail Use% Mounted on
/dev/root ext4 4.0G 1.6G 2.2G 43% /
devtmpfs devtmpfs 34G 283k 34G 1% /dev
/dev/sda1 vfat 511M 9.9M 501M 2% /boot/EFI
/dev/sda5 ext4 1.8T 95G 1.6T 6% /var
none tmpfs 34G 127k 34G 1% /dev/shm
tmpfs tmpfs 34G 0 34G 0% /sys/fs/cgroup
tmpfs tmpfs 34G 0 34G 0% /sys/fs/cgroup/pm
root@FMC2500:/var/sf/backup#

[ABaker94985]

We also have a virtual FMC, and I just logged into there. There are also hundreds of backups on this device, and it's also showing nothing under /var/sf/backup.

[ABaker94985]

I believe I'm in error - the backups that are failing show remote, and I missed that earlier. Thanks all for your time and effort. It was great to go through this exercise for me, so I really appreciate your time.

[balaji.bandi]

I have provided the SFR backup file location.

If you are doing Local backup should be in same folder ( worh checking backup config ? from GUI)

he backup file is saved in the /var/sf/backup directory on the device. If you choose to save a copy of the backup file on the Firepower Management Center, it is saved in the /var/sf/remote-backup directory on the FMC

Also check /var/log folder with du -h

[Eric R. Jones]

I'm sure you got reply on this but it's most frustrating that you can't
delete multiple old backups.
I got around it by mounting the NFS share with our old backups and doing it
that way.
It was much faster even doing it one line a time.
I'm sure you can script this remove the files by date.
Unfortunately it doesn't warn you that this is not possible.