Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 2307 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG - Config disk usage exceeded the threshold

Matt Green2

Hello everyone.

I currently have an issue with a Sophos XG firewall.

The config disk is showing as 97% full.

Is there a way to resize this partition or clear down historic files?

I have tried disabling Synchronized Application control and purging all the logs but the disk usage does not change.

I'm concerned that if this continues to grow it will stop the firewall from working.

Any help greatly appreciated.

I have seen this guide (yes it's hosted on Azure) however I do not know if I can just resize the config disk as it isn't listed in the below guide, I also cannot seem to find information anywhere regarding this volume.

Sophos Firewall: Increase disk capacity of the firewall on Azure

Again any help greatly appreciated.

Thanks



This thread was automatically locked due to age.
Parents
  • 0

    You have to urgently get Sophos to remote in a clear the partition - it's a bug and you are right, you hit 100% and the XG dies. Fixed in MR1 though. 

    Regards

  • 0 in reply to carbon15

    Thanks for the info appreciated Thumbsup

  • 0 in reply to Matt Green2

    Hi Matt Green2 

    You can reset or delete the reports from the reporting database.  This will require a reboot and all reporting data will be lost.

      1. Flushing device reports from CLI

      2. Access the firewall's console via SSH.

      3. Select option 5 for Device Management.

      4. Select option 4 to Flush Device Reports.

      5. Type in y to continue flushing the device reports.

    • As storage is limited on the Sophos Firewall and can fill up if the log amount it receives is very high, it is directly proportionate to the amount of logs the device generates.
    • For some DB tables, the smallest amount of data retention supported is one month. If data get filled up before that, there is no option other than deleting data using the manual purge option in the report setting.
    • To get more storage space, it is recommended to use Central Firewall Reporting and stop reporting on the box.

    Thanks and Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    Hi Bharat hope you are well thanks for the response.

    Are the device reports stored on the /conf volume or on the /var volume?

    Also currently everything is set to go to Central, we have also cleared all reports and logs manually to no avail I am afraid.

    Thanks

  • 0 in reply to Bharat J

    It's not the reports partition - it's the config partition. a different beast altogether. When the config partition fills your XG dies and needs a factory reset to rescue. This will more than likely be NC-81131. 

  • 0 in reply to Matt Green2
    Matt Green2 said:
    currently everything is set to go to Central

    Please share a snapshot of the status of log settings Go to Configure > System services > Log settings

    Also, Please Go to System-->Admininstration --->Backup and Firmware -->Firmware and share the status of the firmware shown on the GUI

    Check the status of on-box-report Sign in to the CLI Console with Telnet or SSH. Select Option 4:  Device Console. Run the following command.

    show on-box-reports

    Thanks and Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • 0 in reply to Matt Green2
    Matt Green2 said:
    currently everything is set to go to Central

    Please share a snapshot of the status of log settings Go to Configure > System services > Log settings

    Also, Please Go to System-->Admininstration --->Backup and Firmware -->Firmware and share the status of the firmware shown on the GUI

    Check the status of on-box-report Sign in to the CLI Console with Telnet or SSH. Select Option 4:  Device Console. Run the following command.

    show on-box-reports

    Thanks and Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

Children
No Data
Unfiltered HTML