First have a look at this article for the most common causes:
http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118719-technote-firesight-00.html
Second, you can poke around in the filesystem and remove some of the obvious bits - logs from previous upgrades etc.
You can use the standard Linux commands to see where the filesystem is being used. For example, navigate up to the root directory and then run:
sudo du -hs * | sort -h
On an older host, the Snort Rule Update (SRU) files can add up quite a bit over time.
Be careful to take care not to delete anything you're unsure about.
