High unmanaged disk usage on /ngfw on FTD 2140

[CiscoBrownBelt]

I am looking to delete some logs/files from the FTD due to this issue and/or bug. I am not trying to delete anything though that could cause issues. I see  most spaced taken on in the /dev/shm/snort

Would deleting files from the different instances in this directory cause any issues? I would assume no. Here is example of one:

admin@FTD:/dev/shm/snort/instance-1/connection$ ls
backup unified_events-2.log.1684400441 unified_events-2.log.bookmark.7029121e-4c83-11ec-9e6f-73234b64a63d

[IFS]

I've got an 1140 HA pair and the active unit throws this same warning every few days and seems to clear up on it's own after a while each time.  I haven't opened a TAC case yet, but it would be helpful to know what is safe to delete from that directory.

I'm currently seeing about 84% disk usage for that directory on my system. (/dev/shm/snort)

[Marvin Rhoads]

There are several bugs that can cause this issue. Most either have a work around or are fixed in one of the newer releases (like 7.0.5 or 7.2.4).

High unmanaged disk space bugs:

https://bst.cisco.com/bugsearch/bug/CSCvt77813
https://bst.cisco.com/bugsearch/bug/CSCvo74833
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb34240
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc30487
https://bst.cisco.com/bugsearch/bug/CSCvy26511

CSCwb34240 is the most commonly encountered one in my experience; but your situation may vary.