Problem with disk free space.

[n.avramenko87]

I use FirePower 7100 (Version of sensor 5.3.0.3 Version of FireSight 5.4.1.7).I have problems with applying policy to device.And can not update sensor for more new version. Cisco Support Community helps me! Thanks! They and I think that problem may be in disk usage.

What I have oh sensor:

Filesystem     Size     Used          Avail              Use%     Mounted on
/dev/sda5       2.9G     562M       2.2G                 21%         /
/dev/sda1      99M       37M        58M                  39%        /boot
/dev/sda7      67G        67G          0                    100%       /Volume
none            1.9G     136K           1.9G                 1%         /dev/shm

May be problem with /Volume.What folders I could check and delete? Thank you!

[n.avramenko87]

> show disk-manager

Silo                                                  Used Minimum Maximum
Temporary Files                                   2 KB 1 KB 6 KB
Action Queue Results                          0 KB 1 KB 6 KB
Connection Events                              0 KB 15 KB 93 KB
User Identity Events                            0 KB 1 KB 6 KB
UI Caches                                            4 KB 4 KB 9 KB
Backups                                               0 KB 12 KB 31 KB
Updates                                               13 KB 18 KB 46 KB
Other Detection Engine                       0 KB 9 KB 18 KB
Performance Statistics                         242 KB 3 KB 37 KB
Other Events                                        0 KB 6 KB 12 KB
IP Reputation & URL Filtering               0 KB 7 KB 15 KB
Archives & Cores & File Logs                31 KB 12 KB 62 KB
RNA Events                                          0 KB 12 KB 50 KB
File Capture                                          0 KB 18 KB 56 KB
IPS Events                                            18 KB 28 KB 62 KB

[n.avramenko87]

I found a large log file! - 63 G

admin@Sourcefire3D:/var/log$ du -h top.log.1
63G top.log.1

Can I delete it?

[n.avramenko87]

OO!Now i having problem! Harware problem on sensor! ((( But after reboot all is GOOD!!!! Policy is apply!!!!!!!! THANK YOU!!!

[Pujita Patni]

Hi,

From the output you provided, it looks like the /Volumne is full and you need to delete some files to make some space.

You can delete the old backup files, older software update and patch files.

Please refer: http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118719-technote-firesight-00.html

Thanks,

Pujita

Rate if it helps !

[Jetsy Mathew · Accepted solution]

Hello Team,

* Could you please verify the following :-

cd /var/tmp/

du -sh *

You can clear the /var/tmp/ by using the following . Files under /var/tmp folders are temporary files.:-

rm -rf *

There is known bug where the /Volume gets full because of the Apply_* files.

* Also verify the following :-

   cd /var/sf/updates 

 Remove the old patches if there is any.

* Verify the following backup folder and detection engine folder too.

 cd /var/sf/upgrade_backup

du -sh *

cd /var/sf/detection_engines

du -sh *

Rate if this helps you.

Regards

Jetsy 

[nibble]

I also found an old version along the way:
/Volume/6.2.2/ - this folder was 22G.

[damian1977]

Performing the Command rm -rf * in my POC environment made me lose GUI connection completeley

[dipesh shah]

I deleted log and messages file the /var/log and after that i rebooted the sensor. this is how i fix the issue.

Sensor: Firepower 7110.