Palo Alto Networks Knowledgebase: How and When To Clear Disk Space on a Palo Alto Networks Device

How and When To Clear Disk Space on a Palo Alto Networks Device

51788
Created On 05/09/19 02:17 AM - Last Updated 05/10/19 02:06 AM
Content Release Deployment Hardware PAN-OS
Symptom
Some common symptoms of disk-space getting filled up are:
  • Web interface not loading
  • Certain daemons processes not starting
  • Incomplete tech support bundles
  • System log alerts with "Disk usage for / exceeds limit,  X percent in use, cleaning file system"
  • Unable to download PAN-OS software images or dynamic updates

 


Cause
The PAN-OS file system is divided into various directories. To view partitions and associated disk-space, use the command below:
> show system disk-space 

Filesystem            Size  Used Avail Use% Mounted on
/dev/md2              3.8G  3.1G  581M  85% /                          << root partition
/dev/md5              7.6G  4.2G  3.0G  59% /opt/pancfg .        
/dev/md6              3.8G  3.0G  666M  82% /opt/panrepo
tmpfs                 2.0G  210M  1.8G  11% /dev/shm
cgroup_root           2.0G     0  2.0G   0% /cgroup
/dev/md8               88G  2.4G   81G   3% /opt/panlogs
tmpfs                  12M     0   12M   0% /opt/pancfg/mgmt/lcaas/ssl/private

The PAN-OS file system has a default mechanism to rotate and clear disk-space. In some cases, manual intervention may be required to clear disk space.


Resolution

Option 1: Enable Aggressive Cleaning

This command is available on PAN-OS 7.1.14+, PAN-OS 8.0.7+ and PAN-OS 8.1.0+.

This will automatically truncate all old log files (entries under all *var/log/pan directories matching *.1, ... *.4, *.log.old) if the 95% occupancy alarm is tripped.

> debug software disk-usage aggressive-cleaning <enable|disable>

Also, on PAN-OS versions 8.1.0+, you can enable threshold levels for your clean up using this command:
> debug software disk-usage cleanup ?
+ deep        cleanup with deleting backup logfile
* threshold   percentage threshod of size of system partition to kick off cleanup

> debug software disk-usage cleanup deep threshold 90
This setting is persistent across reboots.

Caveat: Enabling aggressive clean up may clear up logs, rendering logs unavailable for analysis.
 

Option 2: Check and Delete Unnecessary Core Files

Check the output of >show system files to see core files using up a large amount of disk space.
> show system files
/opt/dpfs/var/cores/:
total 4.0K
drwxrwxrwx 2 root root 4.0K Jun 10 20:05 crashinfo

/opt/dpfs/var/cores/crashinfo:
total 0
 
/var/cores/:
total 115M
drwxrwxrwx 2 root root 4.0K Jun 10 20:15 crashinfo
-rw-rw-rw- 1 root root 867M Jun 12 13:38 devsrvr_4.0.3-c37_1.gz
-rw-rw-rw- 1 root root  51M Jun 12 13:39 core.20053
 
/var/cores/crashinfo:
total 16K
-rw-rw-rw- 1 root root 15K Jun 10 20:15 devsrvr_4.0.3-c37_0.info
 

Delete unnecessary core files. A core file can be deemed unnecessary if investigation around the core file is complete or they are very old files.
(This example deletes a device server core file from the management-plane.)

> delete core management-plane file devsrvr_4.0.3-c37_1.gz


Option 3: Delete Rotated Files and Files with Extension .old 

These files contain monitoring details and service related logs on the firewall. They can be deleted safely if you don't need them. If TAC investigates an ongoing issue, you may prefer to keep them until you upload the tech support file to the case manager. 

> delete debug-log ?
> cp-log      Remove cp-log at /opt/var.cp/log/pan/
> dp0-log     Remove dp0-log at /opt/var.dp0/log/pan/
> dp1-log     Remove dp1-log at /opt/var.dp1/log/pan/
> dp2-log     Remove dp2-log at /opt/var.dp2/log/pan/
> mp-global   Remove mp-global at /opt/mp-global/
> mp-log      Remove mp-log at /var/log/pan/

> delete debug-log mp-log file *.1
> delete debug-log mp-log file *.2
> delete debug-log mp-log file *.3
> delete debug-log mp-log file *.4
> delete debug-log mp-log file *.old


Option 4: Clear Any packet-diag Logging If Enabled

Run > debug dataplane packet-diag show setting to check if packet-diag is enabled.
> debug dataplane packet-diag show setting

DP dp0:

--------------------------------------------------------------------------------
Packet diagnosis setting:
--------------------------------------------------------------------------------
Packet filter
  Enabled:                   no
  Match pre-parsed packet:   no            
--------------------------------------------------------------------------------
Logging
  Enabled:                   no     <<<  No is the default value and means not enabled.

> debug dataplane packet-diag show setting

DP dp0:

--------------------------------------------------------------------------------
Packet diagnosis setting:
--------------------------------------------------------------------------------
Packet filter
  Enabled:                   no
  Match pre-parsed packet:   no            
--------------------------------------------------------------------------------
Logging
  Enabled:                   yes   <<< Means packet-diag is enabled.

To clear out packet-diag setting and the logs, run below commands:
> debug dataplane packet-diag clear all

Packet diagnosis setting set to default.

 > debug dataplane packet-diag clear log log 

dataplane debug logs cleared


​​​​​​Option 5: Delete Any Debug pcaps or Debug-filter pcaps

> delete debug-filter file <file-name>
> delete pcap directory *


Option 6: Delete Old Content and Antivirus Update Packages:

> delete content cache old-content
> delete anti-virus update <unused anti-virus>

Apart from these options, there have been various improvements in the latest PAN-OS release to best utilize disk-space.


Additional Information
For additional information, please review the following articles:

How to Delete Unnecessary Downloaded Software Versions
How to delete configurations through the CLI
How to Delete Saved Configuration Files


Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language