FirePOWER Backup Job fails

[ammann9113]

Hello everyone

I've scheduled a backup job to run weekly. For that I created a backup profile is pretty much straight forward (see the attached screenshot).

Unfortunately this does not work. The only thing the job does is running into an "Backup died unexpectatly" error after a few seconds.

I did not find any more clues and since the configuration is quite simple, I really don't now where to go from here.

Any ideas?

Thanks!

PS: I'm running 6.1

[Oliver Kaiser]

Can you post the output of the following command to verify why your backup is failing (make sure to run a backup before!)

admin@firesight:~$ cat /var/log/messages | grep backup

[ammann9113]

I've just tried another backup. Below the result.

Edit: It does not matter if I "Email when complete" or not

Edit2: I've updated to the latest (6.1.0.1 I think) version. No change in the matter

Dec  7 06:48:46 firepower sudo:      www : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/mv /var/tmp/backupG0i0/files_not_to_tar /var/tmp/backupOSB8/files_not_to_tar
Dec  7 06:48:46 firepower sudo:      www : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/mv /var/tmp/backupG0i0/files_to_tar /var/tmp/backupOSB8/files_to_tar
Dec  7 06:48:46 firepower sudo:      www : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/sf-backup.pl /var/sf/backup/TEST.tar.gz
Dec  7 06:49:00 firepower sf-backup[27357]: Backup died unexpectedly
Dec  7 06:49:05 firepower sf-backup[27357]: Exiting... (1)

[Oliver Kaiser]

I tried reproducing it but had no success so far. I would have hoped there would be more logging output, but unfortunetly the error message is too generic.

The only issues I could think of would be resource usage related. Can you post the results of the following commands:

root@firesight:/Volume/home/admin# free -m -t

root@firesight:/Volume/home/admin# df -h

root@firesight:/Volume/home/admin# iostat

You will probably need a TAC case to resolve this, but lets verify the utilization before that.

[ammann9113]

I attached a textfile with the output.

Unfortunately I do not have a service contract for the device since it's just my homelab playground...

At some point the only thing to do will be to reset everything and start from scratch. Do you have any other ideas before I'll have to do that?

[Oliver Kaiser]

You have provisioned 2GB memory. Your FMC already started swapping, so that might be the issue. A minimum of 8GB is recommended to run virtual FMC... Try adding more memory and try the backup again.

[ammann9113]

Well, sounds reasonable. But...

I've got a 5506-X. I did not expect that I have to reallocate memory? I did see the high memory usage of the firepower module but I thought, since it all is in one box, it has to be right...

[Oliver Kaiser]

I thought you were running firepower management center. I guess you manage firepower via asdm, correct?

in that case you cannot add additional memory. I thought you were running FMC as a virtual machine

[ammann9113]

Yes, I manage it via ASDM. Sorry that I did not clarify that..

The system load on the FirePOWER dashboard shows 44% memory load. The statistics at the monitoring tab shows a memory load of 77%. Pretty confusing.

Well.. what would you do? :-)

[Oliver Kaiser]

I would recommend to re-install and try again. For further troubleshooting TAC / engineering would be needed IMO.

[ammann9113]

Ok, thanks!

[ammann9113]

One follow-up question:

Is there something I have to mind regarding the reinstall? Or can I just "sw-module module sfr uninstall" and then follow the normal installation procedure?

Thanks again!

[Oliver Kaiser · Accepted solution]

No - thats it. Uninstall the sfr module and re-install. :)