On our FirePower 1120 we have the following partition usage:
Filesystem Size Used Avail Use% Mounted on
rootfs 7.3G 170M 7.1G 3% /
devtmpfs 7.3G 52M 7.3G 1% /dev
tmpfs 7.9G 500K 7.9G 1% /run
tmpfs 7.9G 2.3M 7.9G 1% /var/volatile
/dev/sda1 7.3G 1.4G 5.5G 20% /mnt/boot
/dev/sda2 923M 54M 823M 7% /opt/cisco/config
/dev/sda3 923M 25M 851M 3% /opt/cisco/platform/logs
/dev/sda4 28G 45M 26G 1% /var/data/cores
/dev/sda5 115G 115G 246M 100% /ngfw
cgroup_root 7.9G 0 7.9G 0% /dev/cgroups
tmpfs 1.0M 0 1.0M 0% /var/data/cores/sysdebug/tftpd_logs
> show disk-manager
Silo Used Minimum Maximum
Temporary Files 0 KB 1.676 MB 6.704 MB
Action Queue Results 0 KB 1.676 MB 6.704 MB
User Identity Events 0 KB 1.676 MB 6.704 MB
UI Caches 4 KB 5.027 MB 10.056 MB
Backups 0 KB 13.408 MB 33.521 MB
Updates 0 KB 20.112 MB 50.280 MB
Other Detection Engine 0 KB 10.056 MB 20.112 MB
Performance Statistics 35 KB 3.352 MB 40.225 MB
Other Events 0 KB 6.704 MB 13.408 MB
IP Reputation & URL Filtering 0 KB 8.380 MB 16.760 MB
arch_debug_file 129 KB 33.521 MB 201.123 MB
Archives & Cores & File Logs 87.816 MB 13.408 MB 67.041 MB
RNA Events 0 KB 13.408 MB 53.633 MB
File Capture 0 KB 33.521 MB 67.041 MB
Unified High Priority Events 0 KB 50.280 MB 117.321 MB
Connection Events 2.743 MB 59.079 MB 118.159 MB
IPS Events 0 KB 40.225 MB 100.562 MB
/ngfw/Volume/6.4.0/tmp# du -hsx -- * | sort -n -r | head -n 20
208K cacert.pem
44G snort.pcap.0
27G snort.pcap.2
22M geodb
22G snort.pcap.3
20K pruning_status.msg
14G snort.pcap.1
8.0K v6h29DWzi9
8.0K upgrade-patch
4.0M vdb_341
4.0M vdb_309
4.0K userappid.conf
4.0K device_connection.json
0 sfd_reset.lock
0 sf_xml.lock
0 register.lock
0 pruning.lock
0 manage_interfaces.lock
0 de_log.amw
0 banner.txt
Deleting files under /ngfw/Volume/6.4.0/tmp solved the issue. But how come they ended up there in the first place? What could have filled this partition so much?
