Palo Alto Networks Knowledgebase: How and When to Clear Disk Space on the Palo Alto Networks Device

How and When to Clear Disk Space on the Palo Alto Networks Device

25781
Created On 11/28/18 09:11 AM - Last Updated 11/28/18 09:12 AM
Content Release Deployment
Resolution

Details

The Palo Alto Networks device deletes the oldest log data when the logdb-quota is reached. The device purges logs based upon categories seen in show system logdb-quota.

Refer to When are Logs Purged on the Palo Alto Networks Devices? for behavior of purging on different platforms.

 

The root partition can become full, requiring manual file deletion. If the root is full, the device cannot to perform maintenance tasks such as content installs (AV, APP/Threat, URL, DB) or generate tech support files.  To check the status of the root partition, use the show system disk-space command. Core files consume large amounts of disk space: show system files. Delete large core files: delete core management-plane file <filename>.

 

Use these commands to view and delete core files:

 

> show system disk-space
 
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda3            3.8G  3.8G    0 100% /
/dev/sda5            7.6G  3.4G  3.8G  48% /opt/pancfg
/dev/sda6            3.8G  2.7G  940M  75% /opt/panrepo
tmpfs                493M  36M  457M  8% /dev/shm
/dev/sda8              51G  6.6G  42G  14% /opt/panlogs

 

  1. Check the output of show system file to see core files using up a large amount of disk space.
    > show system files
    /opt/dpfs/var/cores/:
    total 4.0K
    drwxrwxrwx 2 root root 4.0K Jun 10 20:05 crashinfo
    
    /opt/dpfs/var/cores/crashinfo:
    total 0
     
    /var/cores/:
    total 115M
    drwxrwxrwx 2 root root 4.0K Jun 10 20:15 crashinfo
    -rw-rw-rw- 1 root root 867M Jun 12 13:38 devsrvr_4.0.3-c37_1.gz
    -rw-rw-rw- 1 root root  51M Jun 12 13:39 core.20053
     
    /var/cores/crashinfo:
    total 16K
    -rw-rw-rw- 1 root root 15K Jun 10 20:15 devsrvr_4.0.3-c37_0.info

     

  2. Delete unnecessary core files:
    > delete core management-plane file devsrvr_4.0.3-c37_1.gz
    (this example deletes a device server core file from the management-plane).
  3. Delete rotated files and files with extention .old as follows. These files contain monitoring details and service related logs on the firewall. Hence they can be deleted safely if you don't need them. If TAC investigates an ongoing issue,  you may prefer to keep them until you upload the tech support file to the case manager. 

    > delete debug-log mp-log file *.1
    > delete debug-log mp-log file *.2
    > delete debug-log mp-log file *.3
    > delete debug-log mp-log file *.old
    

 

       

owner: bpappas



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language