Status critical: High Unmanaged disk usage on /Volume

[LuigiDiFronzo9542]

Hello,

I have this message in the Health Monitor, however taking a look in the partitions the most high ocuppation is used by /Var.

Please, how can I do for free some space from this partition.

I put an image with the occupation of the partitions.

Thanks

[marce1000]

  - Have a look at these bug reports : https://bst.cloudapps.cisco.com/bugsearch?pf=prdNm&kw=High%20Unmanaged%20disk%20usage%20on&bt=custV&sb=anfr

   M.

[LuigiDiFronzo9542 · Accepted solution]

Thanks for the answer.

The space warning is related to the FMC, and this is a virtual device.

I was able to manage the space overhead on FMC by inspecting the folder /var/sf/SRU and deleting some old Sourcefire rule updates.

Thanks for the help.

[Marvin Rhoads]

As you discovered, old SRUs are one common source of this issue. There are others as well, mostly fixed in more recent versions of code. Sometimes the upgrade will prevent new storage issues from occurring but will not always remove old problems.

I recommend  moving to a suggested release (e.g. 7.4.2.2) if you haven't already.

[LuigiDiFronzo9542]

I have another files in the virtual FMC: Cisco_Firepower_SRU-AAAA-MM-DD-001-vrt.sh.REL.tar. Is it safe to delete these files, at least the old ones?

Thanks.

[Marvin Rhoads]

@LuigiDiFronzo9542 yes, old SRU files are generally safe to delete.

[LuigiDiFronzo9542]

Thanks Marvin,

In the case of old SRU, trying to delete the old files I received the message "rm: remove write-protected regular file 'Cisco_Firepower_SRU-2020-02-25-001-vrt.sh.REL.tar'?".

It's still safe to delete the files?

By other way, in the directory /var/sf/cloud_download/ are many other files of this:

-. "full_bcdb_rep_new_9.124.bin" and "part_bcdb_rep_new_9.124.bin", I understand that these old files can also be deleted, is that correct?

Many thanks.

[Marvin Rhoads]

File removal should be done (carefully!) as root user.

I am not familiar with the bin files you mentioned.

In case of doubt, open a TAC case. Also, always be certain that you have a backup before commencing any such activity.