IDS v4.x reporting Root Filesystem full

[8rpalmer]

I have 2 version 4 IDS appliances that all of a sudden are reporting that the root filesystem is full during a signature update. Can anyone suggest where to start looking for the culprit? I've already ensure all logging (IP/Event) has been shut off, and removed or cleared all log viles in /var and /var/spool, as well as the messages(x) files.

Anyone?

[jamesand]

If you have had any problems with upgrades in the past, you may have .pkg files (over a meg a piece) left over from a failed upgrade. Log into the service account and remove any .pkg files that are over a meg in the following directory: /usr/cids/idsRoot/var/updates