DotW: Disk space issue on root

DotW: Disk space issue on root

79480
Created On 09/25/18 18:55 PM - Last Modified 07/18/19 20:12 PM


Resolution

In this week's Discussion of the Week, we're taking a look at a question about a filled up root partition and how to free up space. Let's take a look at common causes for the predicament and a few painless remedies. Community member scawsey13 poses the question in our discussion forum.

 

diskspace

 

A couple of events can cause the root partition to slowly or rapidly fill up. In general, no service interruptions should result from the root partition being full, as it is not used for any operational storage. However, a full root partition can cause upgrades or certain packet captures to fail.

 

One common cause of a filled partition results when an admin is troubleshooting certain processes and creates core files. These files are stored on the root and remain there until deleted by the administrator.

 

> show system files

/var/cores/:
total 454M
-rw-rw-rw- 1 root root 453M Feb  1 13:43 mgmtsrvr_7.0.3_0.tgz
drwxrwxrwx 2 root root 4.0K Feb  1 13:43 crashinfo

/var/cores/crashinfo:
total 0
-rw-r--r-- 1 root root 0 Feb  1 13:43 mgmtsrvr_7.0.3_0.info

These files can be exported using the scp or tftp export command, then deleted to free up space on the firewall:

 

> scp export core-file management-plane from mgmtsrvr_7.0.3_0.tgz to user@10.0.0.10:/home/ 
user@10.0.0.10 's password: ********
mgmtsrvr_7.0.3_0.tgz                      100%  453MB  46.4MB/s   00:12 
>admin@myNGFW>

> delete core management-plane file mgmtsrvr_7.0.3_0.tgz
> delete core management-plane file crashinfo\mgmtsrvr_7.0.3_0.info

 

Another type of file that can take up disk space, on smaller platforms with limited space, are the system logs. These can be pruned and old files deleted:

 

delete debug-log mp-log file *.1
delete debug-log mp-log file *.2
delete debug-log mp-log file *.3
delete debug-log mp-log file *.old
 
For troubleshooting purposes, some processes allow for packet capture to be activated so packets can be analysed. An administrator should delete these after ending the troubleshooting session:
 
> debug ike pcap 
> delete   delete
> off      off
> on       on
> show     show
> view     view
> delete pcap directory <tab>

 

 
You can follow the original discussion here: Out of disk space
 
Feel free to leave a comment.
 
Regards,
Tom


Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRXCA0&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language