05-18-2023 06:15 AM
I am looking to delete some logs/files from the FTD due to this issue and/or bug. I am not trying to delete anything though that could cause issues. I see most spaced taken on in the /dev/shm/snort
Would deleting files from the different instances in this directory cause any issues? I would assume no. Here is example of one:
admin@FTD:/dev/shm/snort/instance-1/connection$ ls
backup unified_events-2.log.1684400441 unified_events-2.log.bookmark.7029121e-4c83-11ec-9e6f-73234b64a63d
05-24-2023 11:03 AM
I've got an 1140 HA pair and the active unit throws this same warning every few days and seems to clear up on it's own after a while each time. I haven't opened a TAC case yet, but it would be helpful to know what is safe to delete from that directory.
I'm currently seeing about 84% disk usage for that directory on my system. (/dev/shm/snort)
05-25-2023 06:36 AM
There are several bugs that can cause this issue. Most either have a work around or are fixed in one of the newer releases (like 7.0.5 or 7.2.4).
High unmanaged disk space bugs:
https://bst.cisco.com/bugsearch/bug/CSCvt77813
https://bst.cisco.com/bugsearch/bug/CSCvo74833
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb34240
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc30487
https://bst.cisco.com/bugsearch/bug/CSCvy26511
CSCwb34240 is the most commonly encountered one in my experience; but your situation may vary.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide