topic Re: PA-220 root at 100% in Next-Generation Firewall Discussions

PA-220 root at 100%

janelle.provine — Thu, 27 Jul 2023 19:19:37 GMT

I have found alot of articles to clean the root drive on a PA 220 and so far none of them worked.

PA-220 Version 10.2.2

Re: PA-220 root at 100%

PavelK — Thu, 27 Jul 2023 22:13:11 GMT

are you running on that PA-220 the Global Protect? If yes, you might be hitting below issue addressed in PAN-OS 10.2.4-H3.

PAN-219355
Fixed an issue where disk space became full due to a GPSVC FD leak.

Kind Regards

Pavel

Re: PA-220 root at 100%

Michael.Martin — Thu, 27 Jul 2023 22:39:47 GMT

We have had the same issue with some 220's but not all running 10.2.4. The root partition fills up and then causes a failover in HA pairs. Support has helped us by running a clean-up script on the root partition. They have to log into the Palo root cli to run it, which requires a TAC challenge/response. Your best bet would be to submit a ticket if you haven't already done so and have them take a look.

I hope this helps.

Thank You,

Michael

Re: PA-220 root at 100%

janelle.provine — Fri, 28 Jul 2023 12:15:14 GMT

@Michael.Martin

I opened a ticket a few days ago with support and asked for a root engineer so they would login and clean up the root but I have yet for them to respond to me, so I can to the community to see if there were any ideas since support has been useless to me

Re: PA-220 root at 100%

janelle.provine — Fri, 28 Jul 2023 12:16:10 GMT

Nope my os is 10.2.2

Re: PA-220 root at 100%

ozheng — Fri, 28 Jul 2023 15:04:35 GMT

you can reboot the firewall (flush some temp files), until you got a root engineer.

you can also try to delete some log files in mp-log and dp-log (on PA-220, it is in the same location).

If you really cannot wait the root engineer, factory reset.

Olivier

Re: PA-220 root at 100%

AaronAxvig — Tue, 01 Aug 2023 16:21:21 GMT

10.2.4 was better than 10.2.3 when it comes to 220 disk filling up. No failovers for a few weeks at least, though now they have started occurring again. Only a couple weeks until we get ours replaced with 440s.