cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2827
Views
0
Helpful
2
Replies

Partition /ngfw being used 100%

ea_msk
Level 1
Level 1

On our FirePower 1120 we have the following partition usage:

 

Filesystem Size Used Avail Use% Mounted on
rootfs 7.3G 170M 7.1G 3% /
devtmpfs 7.3G 52M 7.3G 1% /dev
tmpfs 7.9G 500K 7.9G 1% /run
tmpfs 7.9G 2.3M 7.9G 1% /var/volatile
/dev/sda1 7.3G 1.4G 5.5G 20% /mnt/boot
/dev/sda2 923M 54M 823M 7% /opt/cisco/config
/dev/sda3 923M 25M 851M 3% /opt/cisco/platform/logs
/dev/sda4 28G 45M 26G 1% /var/data/cores
/dev/sda5 115G 115G 246M 100% /ngfw
cgroup_root 7.9G 0 7.9G 0% /dev/cgroups
tmpfs 1.0M 0 1.0M 0% /var/data/cores/sysdebug/tftpd_logs

 

> show disk-manager
Silo                                    Used        Minimum     Maximum
Temporary Files                         0 KB        1.676 MB    6.704 MB
Action Queue Results                    0 KB        1.676 MB    6.704 MB
User Identity Events                    0 KB        1.676 MB    6.704 MB
UI Caches                               4 KB        5.027 MB    10.056 MB
Backups                                 0 KB        13.408 MB   33.521 MB
Updates                                 0 KB        20.112 MB   50.280 MB
Other Detection Engine                  0 KB        10.056 MB   20.112 MB
Performance Statistics                  35 KB       3.352 MB    40.225 MB
Other Events                            0 KB        6.704 MB    13.408 MB
IP Reputation & URL Filtering           0 KB        8.380 MB    16.760 MB
arch_debug_file                         129 KB      33.521 MB   201.123 MB
Archives & Cores & File Logs            87.816 MB   13.408 MB   67.041 MB
RNA Events                              0 KB        13.408 MB   53.633 MB
File Capture                            0 KB        33.521 MB   67.041 MB
Unified High Priority Events            0 KB        50.280 MB   117.321 MB
Connection Events                       2.743 MB    59.079 MB   118.159 MB
IPS Events                              0 KB        40.225 MB   100.562 MB
/ngfw/Volume/6.4.0/tmp# du -hsx -- * | sort -n -r | head -n 20
208K	cacert.pem
44G	snort.pcap.0
27G	snort.pcap.2
22M	geodb
22G	snort.pcap.3
20K	pruning_status.msg
14G	snort.pcap.1
8.0K	v6h29DWzi9
8.0K	upgrade-patch
4.0M	vdb_341
4.0M	vdb_309
4.0K	userappid.conf
4.0K	device_connection.json
0	sfd_reset.lock
0	sf_xml.lock
0	register.lock
0	pruning.lock
0	manage_interfaces.lock
0	de_log.amw
0	banner.txt

Deleting files under /ngfw/Volume/6.4.0/tmp solved the issue. But how come they ended up there in the first place? What could have filled this partition so much?

2 Replies 2

ea_msk
Level 1
Level 1
Edited.

ea_msk
Level 1
Level 1

Edited. 

Review Cisco Networking for a $25 gift card