PA-VM 4GB Root Partition 100 Percent Full. - Knowledge Base - Palo Alto Networks

PA-VM 4GB Root Partition 100 Percent Full.

29285

Created On 03/19/20 17:35 PM - Last Modified 05/22/20 01:07 AM

AWS

Microsoft Azure

Virtual Appliance

VMware ESXi

Public Cloud

9.1

PAN-OS

VM-Series

Symptom

PA-VM running PanOS 9.1 suffers from root partition filling up to 100%. Attempts to clear root are not effective

Web interface not loading
Certain daemons processes not starting
Incomplete tech support bundles
System log alerts with "Disk usage for / exceeds limit, X percent in use, cleaning file system"
Unable to download PAN-OS software images or dynamic updates

Use CLI command "show system disk-space" to verify root partition is full.

admin@PA-VM-FW01 > show system disk-space

Filesystem      Size  Used Avail Use% Mounted on
/dev/root       4.0G  4.0G     0 100% /  <=== Note 4GB Root Partition 
none            4.9G  100K  4.9G   1% /dev
/dev/sda5       8.0G  4.3G  3.3G  57% /opt/pancfg
/dev/sda6       4.0G  1.3G  2.6G  34% /opt/panrepo
tmpfs           4.8G  4.1G  819M  84% /dev/shm
/dev/sdb1        99G   20G   74G  22% /opt/panlogs
tmpfs            12M     0   12M   0% /opt/pancfg/mgmt/ssl/private

If PA-VM firewall was launched with an PAN-OS base image version earlier than 8.0, it will be deployed with a 40GB disk by default. Per instructions when upgrading to PanOS 8.1 the system disk should be migrated to a 60GB Disk. Transition your VM-Series firewall from a 40GB hard disk to a 60GB hard disk.

Environment

Platform: PA-VM
PAN-OS / Plugin Version: 9.1
Deployment: Firewall upgrade from Base Image earlier then PAN-OS 8.0

Cause

If PA-VM firewall was launched with an PAN-OS base image version earlier than 8.0, it will be deployed with a 40GB disk by default. The checks performed on upgrade verify available space, not disk size.

Resolution

If you are upgrading from a PAN-OS version earlier than 8.0, transition your VM-Series firewall from a 40GB hard disk to a 60GB hard disk.

Shut down the VM.
On your hypervisor, attach a new 60GB hard drive to the VM-Series firewall. This new disk must be 60GB. The firewall will return an error if another value is assigned.
Power on the VM-Series firewall.
Access the firewall CLI.
Use the following CLI command to verify that the new 60GB hard disk has been added. The new hard disk should be called sdb.
```
 > show system disk-space
```
Use the following CLI command to create a new disk partition to copy the data from the original system disk to the new system disk.
> request system clone-system-disk target sdb
Return to your hypervisor and power off the VM-Series firewall.
Remove the original system disk.
Power on the VM-Series firewall.

Additional Information

A 60GB system disk should have a root partition of about 6-7GB