Disk space again

[jdprovine]

I have gone back and forth on disk space with tac and with the live community. I had tac clean up the log files before and that didn't gain me much. I am trying to prepare for an upgrade to OS 8.x this summer and I want to make sure I do not run out of diskspace and also not break anything trying to do some clean up

I guess I want to know if these need to be cleaned up and verify what they are

/dev/md6 3.8G 3.2G 454M 88% /opt/panrepo - PAN-OS Image repository (are these files that are located device]software)? Do the old OS's need to be deleted? I asked tac once before and they said no and then I asked at another date and they said yes - so I am confused.

/dev/md5 7.6G 3.3G 4.0G 46% /opt/pancfg - PAn-OS configuration is this the device config files and do they affect

[BPry]

@jdprovine,

As a rule of thumb, old OS files should be deleted if you are worried about disk space. Seeing as a maintenance release can be anywhere from high 200-300 MBs leaving these on the disk takes a lot of space. Generally if working on a larger than 3000-series device I only recommend keeping one version down from what you were running. So for example if you are currently running 8.0.7 and your last version was 8.0.4, these should be the only two versions currently installed on the box. 

The pancfg repository is every version of the config file that you keep, out of the box I believe this is set to 100 different versions along with any saved configurations. As your configuration grows in size this will continue to grow the more commits are performed, as it keeps at least a 100 different configuration files back. Consider deleting unneeded saved configuration files, and consider setting the number of versions kept for configuration audits lower if you don't see yourself using this feature often. Generally I'll only keep 25-50 different config versions simply because I don't find myself going back further than that. 

[jdprovine]

@BPry

You should work for PA you are way better than the help I get when I put in a ticket, over the years I think tac has really gone down hill.

This is what I have currently in the software respository . So I can delete everything but 7.1.13 and free ups space in the  /dev/md6 3.8G 3.2G 454M 88% /opt/panrepo - PAN-OS Image repository?

[BPry]

@jdprovine,

Correct. You can delete everything besides 7.1.13 without any issues. 

[jdprovine]

@BPry

And that would free up space in this partition /dev/md6 3.8G 3.2G 454M 88% /opt/panrepo - PAN-OS Image repository

[BPry]

@jdprovine,

Correct this woud fre up space within /opt/panrepo

[jdprovine]

@BPry

Thanks !!!! you are awesome

[OtakarKlier]

I think you might want to keep the base code 7.1.0 as well.

[BPry]

@OtakarKlier,

It's already been exploded and written to disk, you really don't need it anymore. 

[jdprovine]

@OtakarKlier @BPry

I have already removed 7.1 base image, but I don't know if that means I can no longer roll back

[BPry]

@jdprovine,

The only time that you would need the base image again is if you roll-back major version numbers. So when you actually do install 8.0.* for example and you needed to roll-back to 7.1.* you would need to have the base image downloaded. If you simply downgrade minor version numbers, for example 8.0.7 to 8.0.4, there is no need to have the base image downloaded. 

[jdprovine]

@BPry

So I would be able to download 7.1 again if I needed to roll back from 8? I am planning to go to some version of 8.0 this summer, which is why I was trying to do some clean up of the repository. I figure that it will require me to install 8.0 base and then a second download install to go to the version I choose of 8 to be on

[BPry]

@jdprovine,

Correct. If you needed to roll back from 8 you would want to have 7.1.0 on disk so that it can be exploded to create a sole boot image with all of the bits and pieces you would need to go back to 7.1.*. 

When you move to 8.0.* you'll need to have 8.0 base downloaded. Keep in mind that Palo Alto has recently modified their upgrade recommendations so that you actually install the base image and restart, and then install the maintenance release.

Larger units that don't have a storage constraint shouldn't technically run into any issue simply downloading the base image and then installing the maintenance image only. However since both base and maintenance installer packages are exploded on-disk and used to piece together all the parts needed to form an installer image to write to the system volume this takes quite a bit of space. If you are unsure if you have the storage space I would simply follow the new guidelines; but the only units that have really seen an issue to-date that I've heard of are the PA-200/220, PA-500, PA-2000, and PA-4000. Without knowing how much clutter you actually have on disk it's kind of hard to recommend against simply following the new guidelines. 

[jdprovine]

@BPry

I did not realize there was a time when you didn't have to reboot after the base image and prior to the maintenance releases. Are you sure you don't work for PA? LOL you certainly know alot thanks!!! 🙂