Frequent high root partition usage alert on a VM-Series firewall

• VM-Series firewall may encounter frequent alerts of high root partition usage.
• System log alerts with "Disk usage for / exceeds limit,  X percent in use, cleaning file system".
• Unable to access GUI and/or CLI.
• In some cases, firewall is unable to boot up properly and enters Maintenance mode.

• VM-Series firewalls 
• PAN-OS version below 11.1.x
• VM upgraded to 11.1.x or later
• Aggressive cleaning is enabled.

• VM-Series firewall deployed/launched with PAN-OS 10.1.x, 10.2.x, or 11.0.x image has root partition space of 6.9 GB.
• Upgrade to newer PAN-OS 11.1.x causes the warning messages as the newer PAN-OS require higher root partition.
• Software upgrade to PAN-OS 11.1.x does not change the root partition space allocation.
• This example below illustrates the issue of a software upgrade from 10.x to 11.x with root partition still at 6.9 GB.

admin@vmseries-fw1> show system disk-space
Filesystem      Size  Used Avail Use% Mounted on
/dev/root       6.9G  4.8G  1.8G  73% /
none            7.9G  104K  7.9G   1% /dev
/dev/sda5        16G  1.4G   14G  10% /opt/pancfg
/dev/sda6       7.9G  2.0G  5.6G  26% /opt/panrepo
tmpfs            12G  6.7G  4.7G  59% /dev/shm
cgroup_root     7.9G     0  7.9G   0% /cgroup
/dev/sda8        21G   51M   20G   1% /opt/panlogs
tmpfs            12M     0   12M   0% /opt/pancfg/mgmt/lcaas/ssl/private

admin@vmseries-fw1> debug swm history
Command                                               Status   Date
--------------------------------------------------------------------------------
load http://10.0.2.100/pub/repository/panos/images/re Success  11/15/24 16:49:03
load http://10.0.2.100/pub/repository/panos/images/re Success  11/15/24 16:49:34
load http://10.0.2.100/pub/repository/plugins/images/ Success  11/15/24 16:49:37
bootstrap maint maint 11.0.4-h6                       Success  11/15/24 16:49:41
bootstrap sysroot0 panos 11.0.4-h6                    Success  11/15/24 16:52:52
bootstrap pancfg content 11.0.4-h6                    Success  11/15/24 16:52:59
bootstrap panrepo plugin 11.0.4-h6                    Success  11/15/24 16:53:01
boot sysroot0                                         Success  11/15/24 16:53:02
firstboot                                             Success  02/05/25 00:46:51
install --category hsm --rpm lunasa-5.4               Success  02/05/25 00:49:33

1. Redeploy the VM using the PAN-OS 11.1 or newer version. This causes the root partition to 12GB of disk space.
2. Software upgrade from older PAN-OS to 11.1.x will not increase the root partition a redeployment is required.
3. Here is the sample output of a redeployed firewall with PAN-OS 11.1.2-h3 image .

admin@vmseries-fw2> show system disk-space
Filesystem      Size  Used Avail Use% Mounted on
/dev/root        12G  5.1G  6.2G  46% /
none            7.9G  104K  7.9G   1% /dev
/dev/sda5        16G  1.4G   14G  10% /opt/pancfg
/dev/sda6       7.9G  2.0G  5.6G  26% /opt/panrepo
tmpfs            12G  6.7G  4.7G  59% /dev/shm
cgroup_root     7.9G     0  7.9G   0% /cgroup
/dev/sda8        11G   34M   11G   1% /opt/panlogs
tmpfs            12M     0   12M   0% /opt/pancfg/mgmt/lcaas/ssl/private

admin@vmseries-fw2> debug swm history

Commmand                                                                                             Status   Date
------------------------------------------------------------------------------------------------------------------------------
load http://10.0.2.100/pub/repository/panos/images/releng/TGZS/PanOS_vm-11.1.0.tgz                   Success  04/15/24 02:48:09
load http://10.0.2.100/pub/repository/panos/images/releng/TGZS/PanOS_vm-11.1.2-h3.tgz                Success  04/15/24 02:48:31
bootstrap maint maint 11.1.2-h3                                                                      Success  04/15/24 02:48:34
bootstrap sysroot0 panos 11.1.2-h3                                                                   Success  04/15/24 02:52:57
bootstrap pancfg content 11.1.2-h3                                                                   Success  04/15/24 02:53:07
bootstrap panrepo plugin 11.1.2-h3                                                                   Success  04/15/24 02:53:10
boot sysroot0                                                                                        Success  04/15/24 02:53:11
load /mnt/swm/panrepo/releases/11.1.0/IMAGES/vm_series-5.0.0                                         Success  04/15/24 02:53:19
load /mnt/swm/panrepo/releases/11.1.0/IMAGES/openconfig-2.0.0-c3                                     Success  04/15/24 02:53:30
load /mnt/swm/panrepo/releases/11.1.0/IMAGES/dlp-5.0.0                                               Success  04/15/24 02:53:33
load /mnt/swm/panrepo/releases/11.1.2-h3/IMAGES/dlp-5.0.1                                            Success  04/15/24 02:53:37
load /mnt/swm/panrepo/releases/11.1.2-h3/IMAGES/openconfig-2.0.0                                     Success  04/15/24 02:53:47
load /mnt/swm/panrepo/releases/11.1.2-h3/IMAGES/vm_series-5.0.1                                      Success  04/15/24 02:53:53
firstboot                                                                                            Success  02/05/25 00:41:52
install --category hsm --rpm lunasa-5.4                                                              Success  02/05/25 00:44:37