In such a case, it is a good idea to identify the rule that the packets match on the firewall and the inspection (Snort) engines, and also check the conditions/reasons of the intended rule (that is supposed to match). At minimum considering these 3 ...
The output of df -h may not always be shown all the paths of interest. df -ah shows all the file systems and their mount points.
For example, sda4 is mounted at 2 points that both can contribute to high disk space utilization:
admin@firepower:~$ df...
In version 9.13+ FPR2100 reimage results in appliance mode. The correct way to convert to the platform mode is as follows:
1. Log in to the ASA in the appliance mode with the admin user and run "no fxos mode appliance".
2. write memory and reload.
...
