07-31-2017 12:37 AM - edited 03-08-2019 11:32 AM
Dear Community,
I have a strange behavoir on many of our Cisco 800 series routers. Images are stored inside flash, but I cannot see them and even formating does not remove them. But it is still booting from flash. You can see the files inside rommon only.
Secure-Boot not set (see output).
Do you know how to delete these hidden images? From rommon not possible i think and flash is not removeable.
---
Router#show version
Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.1(4)M5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 04-Sep-12 21:52 by prod_rel_team
ROM: System Bootstrap, Version 15.1(4r)M, RELEASE SOFTWARE (fc1)
Router uptime is 4 minutes
System image file is "flash:c800-universalk9-mz.SPA.151-4.M5.bin"
Cisco C886VA-W-E-K9 (revision 1.0) with 354304K/38912K bytes of memory.
1 DSL controller
1 Ethernet interface
4 FastEthernet interfaces
1 Gigabit Ethernet interface
1 ISDN Basic Rate interface
1 ATM interface
1 terminal line
1 Virtual Private Network (VPN) Module
1 cisco Embedded AP (s)
DRAM configuration is 32 bits wide
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash (Read/Write)
Configuration register is 0x2102
Router#show secure bootset
%IOS image and configuration resilience is not active
Router#dir flash:
Directory of flash:/
No files in directory
200986624 bytes total (82407424 bytes free)
07-31-2017 03:28 AM
Hi
does it show anything if you just run dir for falsh 1 and 0 too , bit strange that show file system output with the 2 flash names I checked my 800 series and they all look exactly the same as below
File Systems:
Size(b) Free(b) Type Flags Prefixes
- - opaque rw archive:
- - opaque rw system:
- - opaque rw tmpsys:
- - opaque rw null:
- - network rw tftp:
262136 228286 nvram rw nvram:
* 128286720 42356736 disk rw flash:#
- - opaque wo syslog:
- - opaque ro xmodem:
- - opaque ro ymodem:
- - network rw rcp:
- - network rw http:
- - network rw ftp:
- - network rw scp:
- - opaque ro tar:
- - network rw https:
- - opaque ro cns:
is there any boot parameters configured ...show run | I boot
you could try this too if you know the name of the files
delete /force /recursive flash:c880data-universalk9-mz.154-3.M7.bin
07-31-2017 03:42 AM
Thanks for your reply!
- No boot parameters configured
- I know the name of the blocking files from rommon, but it shows "file not found" when trying to delete from "enable mode". deleting from rommon not possible (no command for that).
- flash:1: is Wireless Access Point directory. No problem here.
- flash:0: is normal flash directory. Same as "dir flash:"
So still no solution here.
07-31-2017 04:18 AM
Hi
you should be able to delete in rommon with delete flash:.......
it sounds as if flash is corrupted , is the router under support you could ask TAC to replace it , I have had issues with flash on 800 series before going , got them replaced just by showing TAC flash was no longer readable
or if it has USB you could setup the files to boot from there instead so you have something accessible to go from
Rommon:
Enter ? or help at the ROM monitor prompt to display a list of available commands and options, as follows:
rommon 1 > ?
alias set and display aliases command
boot boot up an external process
break set/show/clear the breakpoint
confreg configuration register utility
cont continue executing a downloaded image
context display the context of a loaded image
cookie display contents of cookie PROM in hex
copy Copy a file-copy [-b <buffer_size>] <src_file> <dst_file>
delete Delete file(s)-delete <filenames ...>
dir List files in directories-dir <directory>
dis display instruction stream
dnld serial download a program module
format Format a filesystem-format <filessystem>
frame print out a selected stack frame
fsck Check filesystem consistency-fsck <filesystem>
help monitor builtin command help
history monitor command history
meminfo main memory information
mkdir Create dir(s)-mkdir <dirnames ...>
more Concatenate (type) file(s)-cat <filenames ...>
rename Rename a file-rename <old_name> <new_name>
repeat repeat a monitor command
reset system reset
rmdir Remove a directory
set display the monitor variables
stack produce a stack trace
sync write monitor environment to NVRAM
sysret print out info from last system return
tftpdnld tftp image download
unalias unset an alias
unset unset a monitor variable
xmodem x/ymodem image download
08-08-2017 01:08 AM
Dear Mark,
unfortunately this is not the case on my router. The following commands are available from rommon:
alias set and display aliases command
boot boot up an external process
break set/show/clear the breakpoint
confreg configuration register utility
cont continue executing a downloaded image
context display the context of a loaded image
cookie display contents of motherboard cookie PROM in hex
dev list the device table
dir list files in file system
frame print out a selected stack frame
help monitor builtin command help
history monitor command history
iomemset set IO memory percent
meminfo main memory information
repeat repeat a monitor command
reset system reset
rommon-pref Select ROMMON
set display the monitor variables
showmon display currently selected ROM monitor
stack produce a stack trace
sync write monitor environment to NVRAM
sysret print out info from last system return
tftpdnld tftp image download
unalias unset an alias
unset unset a monitor variable
So still no explainaition why nearly all of our 300 routers dont show the IOS-image in IOS mode, deleting/formatting does not erase flash, and files are only visible from rommon. And no way to delete them from rommon.
08-08-2017 02:02 AM
at this stage I would open a TAC case under one of the devices with Cisco direct
08-08-2017 06:26 AM
If you "fsck flash:" (from IOS), does it change anything? Does "dir /all" report anything different from just "dir"?
08-10-2017 03:10 AM
Dear Iulian,
thanks for your reply. We ran the commands with the following output, but no improvement:
Router#fsck flash:
Starting File System integrity check
NOTE: File System will be deinited and later rebuilt
Starting partition 0 Analysis
Boot Sector/Boot Parameter Block check ...[Passed]
DIB not present
DIB & Monlib check ...[Passed]
Partition Init check ...[Passed]
Directory entries check ...[Passed]
fsck of flash: complete
Router#dir /all flash:
Directory of flash:/
5 -rw- 660 Aug 3 2017 09:31:48 +02:00 vlan.dat
200986624 bytes total (82288640 bytes free)
Router#dir /all
Directory of flash:/
5 -rw- 660 Aug 3 2017 09:31:48 +02:00 vlan.dat
200986624 bytes total (82288640 bytes free)
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: