Error on the sensor.

[n.avramenko87]

Hello! I have a lot of problems with firepower and can not to configure it. I have an error on sensor. What it si mean? Help me please!

[n.avramenko87]

Thank you for help! If i see admin@Sourcefire3D:/var/sf/updates$ i see only old updates. I think it is not good.

Command pmtool status |grep sftunnel - sftunnel dowm. Is it bad?

[Jetsy Mathew · Accepted solution]

Hello Team,

As i guessed the issue is with the communication channels in the sensor.

Sftunnel is the main communication channel between the FMC and sensor.

Here you can see the service is down and thus you cannot push upgrade as well as cannot reapply the AC policy.

Please try restarting the service by elevate as root user.

pmtool enablebyid sftunnel

Verify the status once again.

If its still down, please try resatrting the same.

pmtool restartbyid sftunnel

Rate if this answer helps you.

Regards

Jetsy 

[n.avramenko87]

I reboot device! Now i having :

sftunnel (system) - Running 3960

I try to install updates. But Update Install failed (Update Install failed).

After that i try to check service and -  sftunnel (system) - Down.

Service stoped working after installing updates.

[Jetsy Mathew]

Hello Team,

Verify the /var/log/messages and /var/log/action _queue.log to check whats happening after you push the upgrade.

Regards

Jetsy 

[n.avramenko87]

O!!I I have very strange logs. 17 and 16 june. Why?

[n.avramenko87]

May be problems with disk usage?

[Jetsy Mathew]

Hello,

What is df -h output shows ?

REgards

Jetsy

[n.avramenko87]

Filesystem   Size      Used         Avail       Use%    Mounted on
/dev/sda5    2.9G       562M         2.2G          21% /
/dev/sda1    99M        37M         58M           39% /boot
/dev/sda7     67G       67G 0                       100% /Volume
none           1.9G  128K        1.9G                 1% /dev/shm

[Jetsy Mathew]

Hello Team,

/volume looks full.

Please remove the files from /var/tmp/ folder

cd /var/tmp/

rm -rf *

Recheck the usage once again. If it still not reduced, you have to open a case with TAC to help you here.

Regards

Jetsy 

[n.avramenko87]

If it still not reduced.U try to create new theme. After that i will tell about it! THANK YOU!!!

[n.avramenko87]

OK! I solve problems with free space! And now try to installing updates!

And updates is installing NOW!!!!!!!!!!!!!!!!!!!!!!! WOOO!!!! Thank you for your time!!!

[Jetsy Mathew · Accepted solution]

Hello Team,

Glad to know that it worked well.

Feel free to use Cisco Support forums.

Kindly Rate and mark the answers correct if you feel my posts helped you .

Regards

jetsy 

[n.avramenko87]

It is very interesting! I try ro install updates from updates center - 5.3.0.8 - it ok! All install. Now i trying ti install  Upgrade to 5.4.0. Thera is not this upgrade in update center. I download this upgrade from https://support.sourcefire.com and try to install. I have errors-faild. If i see in file message - a see error 

Sourcefire3D SF-IMS[18448]: [18448] sfmb:SFMB [INFO] Error with accept

What it is mean?

[n.avramenko87]

Thank you for your help! It is very important for me! I start to understand how it is works. But where i can see what series of device i have? 2 or 3? .... O! I find this information!

[Pujita Patni]

Hello, 

This LED is the System Status LED. 

It indicates the system status:

• A green light indicates the system is powered up and operating normally, or powered down and attached to AC power.
• An amber light indicates a system fault.

Here is more info on the same : http://www.cisco.com/c/en/us/td/docs/security/firepower/hw/firepower_device/firepower_7k8k_device/hardware.html

Thanks & Regards,

Pujita

Please rate this post and mark answered if it helps.