Cisco S100V Web Security Virtual Appliance disk extension

[b.gueriane]

Hello, 

please, i have a problem with our WSA, 

The Critical message is:

Disk usage exceeded the maximum limit. Please free up some space

Product: Cisco S100V Web Security Virtual Appliance

Model: S100V

Version: 11.7.3-025

we want to extend disk of the appliance, some one can Help me please ?

Regards

[balaji.bandi]

As per i know the Limit is 2TB maximum (EDIT- found the document confirmed the same) , if anything more not possible i guess.

https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-5/user_guide/b_ESA_Admin_Guide_12_5/b_ESA_Admin_Guide_12_1_chapter_0100010.html#task_1400179

if already 2TB you need to offload the Logs to external server.

[fw_mon]

Hello @b.gueriane 

Cisco S100V is a small model that don't really intended for productive usage because of only two CPU cores and low disk space. The partition schema on WSA cannot be changed, so from total 250 GB only a small partition can be used for logging. It is better to start at least with WSA S300v. For any WSA running in a virtual environment it is better to disable local logging, local reporting DB  and local caching and log remotelly instead (as already suggested by @balaji.bandi ).

Run ipcheck command on CLI to confirm that the problem is log related as it could be other reasons for this warning.

For a quick solution reduce a autodeletion period of all logs and disable unnecessary logs. Then delete old log manually.

Additionally your version 11.7.3 is really old and full of bugs and vulnerabilities so it is better to update/replace it ASAP.

[FrejusMA]

Hello @fw_mon 

Thanks for this reply. I am having this issue. My disk is currently at 82%. I am using an S100V as well but with a much recent version AsyncOS 14.5.0 for Web build 537. How can I empty the disk. I really do not want to be surprised by full disk. I'm deleting reporting log every day but it decreasing very slowly.

[fw_mon]

Hello @FrejusMA 

I believe the S100V is too small for productive use. You can switch to S300 and disable local reporting and local logging (at least for access.log, system/proxy log and https log) - send all access logs instead in realtime to AWSR (Cisco Advanced Web Security Reporting - a separate license but considerably cheaper than full-fledged Splunk) or to Splunk. You'll be surprised how AWSR/Splunk is better than WSA/SMA reporting.

Post your ipcheck output here. Which partition reports 82% usage? 

Also consider disabling web cache - the times when web content caching improves performance are gone! This is just a waste of precious oversubscribed virt I/O.

[balaji.bandi]

i would check the logs and delete any logs which is not required.

[amojarra]

Hello @b.gueriane 

[1] If you want to extend the disk, I believe you need to change to S300 or S600 as mentioned ( as mentioned before) 

[2] also you can compress your logs, from GUI>> System Administration >> Log Subscriptions >> select the log >> then enable the Log Compression

[3] you can connect to FTP with your management IP, If you want to backup your files, or delete the old log files 

( to enable FTP : GUI >> Network >> interfaces >> Edit Settings >> make sure FTP is enabled ) 

[4] another thing is you can have some external log servers and push the logs there ( you can keep lower number of logs in your WSA , just in case on troubleshooting, and push same log to log server , you need to create 2 separate log, under Log Subscriptions - as mentioned in Item [2] ) 

[5] if you are facing some proxy crash (service outage) there might be some core files generated on your device, so its better if you have the experience of outage, consult TAC support.  

[6] another thing which consume disk is reporting, there is a way to free-up disk space by removing the reports, But this will remove all the reports  (User Guide for AsyncOS 14.5 for Cisco Secure Web Appliance - GD (General Deployment)   Page 603) 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++