Disk usage issue on Cisco Firepower
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-01-2020 07:26 AM
I have low space in file system /var/ en my cisco firepower sensor, I validated files with big weight and I found a file in path /var/sf/detection_engines that takes a lot of space (110G):
root@SFNGIPSB:/var/sf/detection_engines# du -sh *
110G 5b63061c-a756-11e8-8842-8a7aff71b588
116M 5b6dd3b2-a756-11e8-8842-8a7aff71b588
116M 5b6ed564-a756-11e8-8842-8a7aff71b588
@ciscoCommunity Can I delete this file?
- Labels:
-
NGIPS
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-01-2020 11:22 PM
Older detection engine folders may be deleted. Make sure it's not the one associated with your current policy.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-02-2020 12:05 AM
I suggest to apply these commands to see the actual files occupying sizes
find /home -type f -print0 | xargs -0 du -h | sort -rh | head -n 30
find /ngfw -type f -print0 | xargs -0 du -h | sort -rh | head -n 30
find /var/sf -type f -print0 | xargs -0 du -h | sort -rh | head -n 30
You will see things like update files, logs files, etc not deleted.
**** please remember to rate useful posts
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-03-2020 09:10 AM
Effectively, engine folder with high weight is the one associated with my current policy , the next files have huge weight:
root@SFNGIPSB:/var/sf/detection_engines/5b63061c-a756-11e8-8842-8a7aff71b588# du -sh *
32G instance-1
19G instance-2
14G instance-3
14G instance-4
14G instance-5
18G instance-6
what can I do to free up space?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-03-2020 10:13 AM
You don't want to get this wrong.
**** please remember to rate useful posts
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-03-2020 09:11 AM - edited 08-03-2020 10:08 AM
@Marvin Rhoads Effectively, engine folder with high weight is the one associated with my current policy , the next files have huge weight:
root@SFNGIPSB:/var/sf/detection_engines/5b63061c-a756-11e8-8842-8a7aff71b588# du -sh *
32G instance-1
19G instance-2
14G instance-3
14G instance-4
14G instance-5
18G instance-6
what can I do to free up space?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-03-2020 12:07 PM
I agree with @Mohammed al Baqari to check with TAC first. They should confirm you can delete the old detection engine files.
