Hi, it seems this issue keeps coming back every so often. FTD 2110 HA pair running 6.2.3.10. Disk usage on node 1 is about 46% and node 2 is about 32%. I created a TAC case and Cisco is scratching their heads. All the obvious folders have been cleaned up already such as TMP, SF/Updates, etc.
The majority of the usage seems to be coming from the detection engine folders.
/ngfw/var/sf/detection_engines/9b23xxxxxxxxxxxxxxxxxxxxxxxxxxxxx11a/instance-1/
/ngfw/var/sf/detection_engines/9b23xxxxxxxxxxxxxxxxxxxxxxxxxxxxx11a/instance-2/
/ngfw/var/sf/detection_engines/9b23xxxxxxxxxxxxxxxxxxxxxxxxxxxxx11a/instance-3/
There seems to be tons of logs dating back to when the units were deployed in 2017.
fileperfstats.log.152xxxxxx
ssl-certs-unified.log.153xxxxxx
ssl-nse-debug.log.1513xxxxx
unified_events-1.log.153xxxxx
unified_stats.153xxxxx
Does anyone know whats safe to clean up in these folders? I'm not sure what should be rotated automatically and what needs to be cleaned up manually. So far, no answer from Cisco on this question so figure I would check with the community. Thanks
