Solution to fix high unmanaged disk usage on /ngfw FTD firewall.

[nomair_83]

Symptoms:

FMC is showing high unmanaged disk usage alert on /ngfw.

FTD HA standby unit failed due to low disk space 96% on /ngfw

FTD version 7.0.5

Diagnosis:

Checked the disk utilization on the FTD CLI.

 /opt/cisco/csp was utilizing 62%.

sda6 partition was utilizing 96%

Used below command the list the high disk usage files and later deleted the old troubleshooting files, upgrade files, log files.

find /ngfw -type f -print0 | xargs -0 du -h | sort -rh | head -n 30

Deleted the large file

# rm <filename>

We checked that many open deleted files are still there.

#lsof | grep deleted

lina 11138 11309 lina.core root 134u REG 8,6 40630058805 282929123 /opt/cisco/csp/applications/cisco-ftd.6.2.0.362__ftd_001_JAD204802REX6JI9I4/app_data/disk0/log/asa-ssp_ntp.log.1 (deleted)
lina 11138 11310 lina.core root 134u REG 8,6 40630058805 282929123 /opt/cisco/csp/applications/cisco-ftd.6.2.0.362__ftd_001_JAD204802REX6JI9I4/app_data/disk0/log/asa-ssp_ntp.log.1 (deleted)

We tried to restart the syslog-ng process to clear all the open deleted files but It didn't work.

Solution:

You can run below command and monitor the partition usage.

OmniQuery.pl -db mdb -e "flush logs;"

Some customers directly restarted the firewall, and post reboot, the usage reduced to 9 % for /opt/cisco/csp and 30% for sda6 partition.

Suggested to upgrade to 7.4.2 version.

Thanks

[mocego1482]

High disk usage on the FTD (/ngfw) caused the HA standby unit to fail. Initial troubleshooting involved deleting large log and temporary files, but the space wasn't fully reclaimed due to open deleted files held by the `lina.core` process. Restarting `syslog-ng` didn't resolve this. The suggested solutions were to use `OmniQuery.pl -db mdb -e "flush logs;"` to attempt log flushing or to reboot the firewall, which proved effective in reducing E-ZPassMD disk usage. A long-term solution is to upgrade to FTD version 7.4.2, which likely contains fixes related to disk management. Resolving this on both active and standby units is crucial for restoring HA.

[liza756fiz]

Hello,
The Firepower Management Center (FMC) reported a high unmanaged disk usage alert on the /ngfw partition, which led to the failure of the FTD HA standby unit due to low disk space—specifically, 96% utilization on the sda6 partition. The device was running FTD version 7.0.5. Upon investigation through the CLI, it was observed that /opt/cisco/csp was using 62% of its space, and sda6 was nearly full. Using the find command, the largest files were identified, and old troubleshooting, upgrade, and log files were manually deleted. Despite this, disk usage remained high due to open deleted files still being held by active processes, as confirmed by lsof | grep deleted.   CatMeowSounds App Attempts to resolve the issue by restarting the syslog-ng process were unsuccessful. As a remediation step, the command OmniQuery.pl -db mdb -e "flush logs;" was suggested to flush logs. In several cases, a system reboot successfully cleared the issue, reducing /opt/cisco/csp usage to 9% and sda6 to 30%. As a long-term solution, it is recommended to upgrade to FTD version 7.4.2, which includes improvements in disk usage management and log handling.