FIRESIGHT Disk Usage

[jonwbaldwin]

Is there a method to notify administrators about disk usage on the appliance?  I see the data pruning notification, but that appears to apply to data connections exceeded.  What I am looking for is a notification that the disk is >80% full.  I also assume that data pruning will take place after some pre-determined disk usage threshold is crossed.  Is any of that user configurable? 

[yogdhanu]

There is a health alert module which can be used for disk usage alert. You can turn it on and define the threshold limit as well.

System>health >policy >edit policy

Check the modules Disk usage and Disk status

[chris.proudlock]

Any pruning will be done on the backend via logrotate and you can find the limits in /etc/logrotate.d when you SSH to the appliance.

Though ... I've found some things that should probably be logrotated have not been, such as the /var/log/secure log.

I've seen this grow as large as 40GB but holds information that could be rotated regularly.

[Jetsy Mathew]

Hello Jon,

Refer the following link and enable the health module for disk usage.

http://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Health_Monitoring.html

You can set the limit as 85% or 80 % so that you will receive the health alerts in the Firesight Management Center once its reaches the threshold limit.

Here is the one of the reference link for troubleshooting disk usage issues.

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118719-technote-firesight-00.html

Rate and mark correct the helpful posts.

Regards

Jetsy