Root Partition Full

[NickoKristian]

Hi All,

I am trying to clear root partition on our passive FW.

It was suggested in one of the articles(https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS)that we can try to delete Core Files.

But Im kind of hesitant since its core and might be service impacting.

Any one here can tell me which files can i delete on core files that would not be service impacting?

We have a off prod PA that I have tried to run the commands.

***BELOW IS THE OFF PROD PA**

admin@InnoLabPA440> show system pancfg-directory-usage

4.0G /opt/pancfg
3.7G /opt/pancfg/mgmt
2.8G /opt/pancfg/mgmt/updates
1.4G /opt/pancfg/mgmt/updates/oldcontent
1.4G /opt/pancfg/mgmt/updates/curcontent
475M /opt/pancfg/mgmt/content-images
312M /opt/pancfg/dev
85M /opt/pancfg/mgmt/content-preview
73M /opt/pancfg/mgmt/factory
69M /opt/pancfg/mgmt/devices/localhost.localdomain
69M /opt/pancfg/mgmt/devices
66M /opt/pancfg/mgmt/custom-reports
55M /opt/pancfg/mgmt/reports
46M /opt/pancfg/mgmt/tmp
44M /opt/pancfg/mgmt/factory/pdfcreator_fonts
42M /opt/pancfg/mgmt/saved-configs
22M /opt/pancfg/mgmt/tmp/panorama_pushed
17M /opt/pancfg/mgmt/content-preview/8933-9157
17M /opt/pancfg/mgmt/content-preview/8932-9152
17M /opt/pancfg/mgmt/content-preview/8931-9146
17M /opt/pancfg/mgmt/content-preview/8930-9144
17M /opt/pancfg/mgmt/content-preview/8929-9140
16M /opt/pancfg/tmp
11M /opt/pancfg/mgmt/audit
5.6M /opt/pancfg/mgmt/updates/curiot
5.5M /opt/pancfg/mgmt/updates/oldiot
5.2M /opt/pancfg/mgmt/pdf-reports
5.1M /opt/pancfg/mgmt/pdf-reports/predefined
4.9M /opt/pancfg/mgmt/locale
3.1M /opt/pancfg/mgmt/tmp/ui_content
2.3M /opt/pancfg/mgmt/reports/top-connections
2.3M /opt/pancfg/mgmt/custom-reports/top-connections
2.2M /opt/pancfg/mgmt/reports/top-denied-sources
2.2M /opt/pancfg/mgmt/custom-reports/top-denied-sources
2.2M /opt/pancfg/certificates
1.8M /opt/pancfg/mgmt/factory/certs
1.6M /opt/pancfg/mgmt/reports/top-destinations
1.6M /opt/pancfg/mgmt/custom-reports/top-destinations
1.5M /opt/pancfg/mgmt/replaydb
1.5M /opt/pancfg/certificates/predefined
1.4M /opt/pancfg/mgmt/reports/risk-trend
1.4M /opt/pancfg/mgmt/custom-reports/risk-trend
1.3M /opt/pancfg/mgmt/syslogng/ca.d
1.3M /opt/pancfg/mgmt/syslogng
1.3M /opt/pancfg/mgmt/reports/top-users
1.3M /opt/pancfg/mgmt/reports/top-sources
1.3M /opt/pancfg/mgmt/iot-images
1.3M /opt/pancfg/mgmt/custom-reports/top-users
1.3M /opt/pancfg/mgmt/custom-reports/top-sources
1.2M /opt/pancfg/mgmt/reports/top-denied-destinations
1.2M /opt/pancfg/mgmt/reports/risky-users
1.2M /opt/pancfg/mgmt/custom-reports/top-denied-destinations
1.2M /opt/pancfg/mgmt/custom-reports/risky-users
1.2M /opt/pancfg/cache
1.1M /opt/pancfg/mgmt/reports/top-source-countries
1.1M /opt/pancfg/mgmt/reports/top-http-applications
1.1M /opt/pancfg/mgmt/reports/top-applications
1.1M /opt/pancfg/mgmt/reports/SaaS Application Usage
1.1M /opt/pancfg/mgmt/custom-reports/top-source-countries
1.1M /opt/pancfg/mgmt/custom-reports/top-http-applications
1.1M /opt/pancfg/mgmt/custom-reports/top-applications
1.1M /opt/pancfg/cache/pan
1.0M /opt/pancfg/mgmt/reports/unknown-udp-connections
1.0M /opt/pancfg/mgmt/custom-reports/unknown-udp-connections
1020K /opt/pancfg/mgmt/reports/wildfire-file-digests
1020K /opt/pancfg/mgmt/reports/unknown-tcp-connections
1020K /opt/pancfg/mgmt/reports/top-websites
1020K /opt/pancfg/mgmt/reports/top-vulnerabilities
1020K /opt/pancfg/mgmt/reports/top-viruses
1020K /opt/pancfg/mgmt/reports/top-victims-by-source-countries
1020K /opt/pancfg/mgmt/reports/top-victims-by-destination-countries
1020K /opt/pancfg/mgmt/reports/top-victim-sources
1020K /opt/pancfg/mgmt/reports/top-victim-destinations
1020K /opt/pancfg/mgmt/reports/top-url-users
1020K /opt/pancfg/mgmt/reports/top-url-user-behavior
1020K /opt/pancfg/mgmt/reports/top-url-categories
1020K /opt/pancfg/mgmt/reports/top-technology-categories
1020K /opt/pancfg/mgmt/reports/top-spyware-threats
1020K /opt/pancfg/mgmt/reports/top-rules
1020K /opt/pancfg/mgmt/reports/top-inline-cloud-analysis
1020K /opt/pancfg/mgmt/reports/top-inline-categorization-verdict
1020K /opt/pancfg/mgmt/reports/top-ingress-zones
1020K /opt/pancfg/mgmt/reports/top-ingress-interfaces
1020K /opt/pancfg/mgmt/reports/top-egress-zones
1020K /opt/pancfg/mgmt/reports/top-egress-interfaces
1020K /opt/pancfg/mgmt/reports/top-destination-countries
1020K /opt/pancfg/mgmt/reports/top-denied-applications
1020K /opt/pancfg/mgmt/reports/top-blocked-websites
1020K /opt/pancfg/mgmt/reports/top-blocked-url-users
1020K /opt/pancfg/mgmt/reports/top-blocked-url-user-behavior
1020K /opt/pancfg/mgmt/reports/top-blocked-url-categories
1020K /opt/pancfg/mgmt/reports/top-attacks
1020K /opt/pancfg/mgmt/reports/top-attackers-by-source-countries
1020K /opt/pancfg/mgmt/reports/top-attackers-by-destination-countries
1020K /opt/pancfg/mgmt/reports/top-attacker-sources
1020K /opt/pancfg/mgmt/reports/top-attacker-destinations
1020K /opt/pancfg/mgmt/reports/top-application-categories
1020K /opt/pancfg/mgmt/reports/threat-trend
1020K /opt/pancfg/mgmt/reports/spyware-infected-hosts
1020K /opt/pancfg/mgmt/reports/blocked-credential-post
1020K /opt/pancfg/mgmt/reports/bandwidth-trend
1020K /opt/pancfg/mgmt/custom-reports/wildfire-file-digests
1020K /opt/pancfg/mgmt/custom-reports/unknown-tcp-connections
1020K /opt/pancfg/mgmt/custom-reports/top-websites
1020K /opt/pancfg/mgmt/custom-reports/top-vulnerabilities
1020K /opt/pancfg/mgmt/custom-reports/top-viruses
1020K /opt/pancfg/mgmt/custom-reports/top-victims-by-source-countries
1020K /opt/pancfg/mgmt/custom-reports/top-victims-by-destination-countries
1020K /opt/pancfg/mgmt/custom-reports/top-victim-sources
1020K /opt/pancfg/mgmt/custom-reports/top-victim-destinations
1020K /opt/pancfg/mgmt/custom-reports/top-url-users
1020K /opt/pancfg/mgmt/custom-reports/top-url-user-behavior
1020K /opt/pancfg/mgmt/custom-reports/top-url-categories
1020K /opt/pancfg/mgmt/custom-reports/top-technology-categories
1020K /opt/pancfg/mgmt/custom-reports/top-spyware-threats
1020K /opt/pancfg/mgmt/custom-reports/top-rules
1020K /opt/pancfg/mgmt/custom-reports/top-inline-cloud-analysis
1020K /opt/pancfg/mgmt/custom-reports/top-inline-categorization-verdict
1020K /opt/pancfg/mgmt/custom-reports/top-ingress-zones
1020K /opt/pancfg/mgmt/custom-reports/top-ingress-interfaces
1020K /opt/pancfg/mgmt/custom-reports/top-gtp-victim-sources
1020K /opt/pancfg/mgmt/custom-reports/top-gtp-victim-destinations
1020K /opt/pancfg/mgmt/custom-reports/top-gtp-attacker-sources
1020K /opt/pancfg/mgmt/custom-reports/top-gtp-attacker-destinations
1020K /opt/pancfg/mgmt/custom-reports/top-egress-zones
1020K /opt/pancfg/mgmt/custom-reports/top-egress-interfaces
1020K /opt/pancfg/mgmt/custom-reports/top-destination-countries
1020K /opt/pancfg/mgmt/custom-reports/top-denied-applications
1020K /opt/pancfg/mgmt/custom-reports/top-blocked-websites
1020K /opt/pancfg/mgmt/custom-reports/top-blocked-url-users
1020K /opt/pancfg/mgmt/custom-reports/top-blocked-url-user-behavior
1020K /opt/pancfg/mgmt/custom-reports/top-blocked-url-categories
1020K /opt/pancfg/mgmt/custom-reports/top-attacks
1020K /opt/pancfg/mgmt/custom-reports/top-attackers-by-source-countries
1020K /opt/pancfg/mgmt/custom-reports/top-attackers-by-destination-countries
1020K /opt/pancfg/mgmt/custom-reports/top-attacker-sources
1020K /opt/pancfg/mgmt/custom-reports/top-attacker-destinations
1020K /opt/pancfg/mgmt/custom-reports/top-application-categories
1020K /opt/pancfg/mgmt/custom-reports/threat-trend
1020K /opt/pancfg/mgmt/custom-reports/spyware-infected-hosts
1020K /opt/pancfg/mgmt/custom-reports/sctp-security-events
1020K /opt/pancfg/mgmt/custom-reports/sctp-events-summary
1020K /opt/pancfg/mgmt/custom-reports/sctp-error-causes
1020K /opt/pancfg/mgmt/custom-reports/gtp-v2-causes
1020K /opt/pancfg/mgmt/custom-reports/gtp-v1-causes
1020K /opt/pancfg/mgmt/custom-reports/gtp-users-visiting-malicious-url
1020K /opt/pancfg/mgmt/custom-reports/gtp-security-events
1020K /opt/pancfg/mgmt/custom-reports/gtp-malicious-wildfire-submissions
1020K /opt/pancfg/mgmt/custom-reports/gtp-events-summary
1020K /opt/pancfg/mgmt/custom-reports/blocked-credential-post
1020K /opt/pancfg/mgmt/custom-reports/bandwidth-trend
852K /opt/pancfg/mgmt/global
784K /opt/pancfg/mgmt/transforms
520K /opt/pancfg/mgmt/jobdb
412K /opt/pancfg/certificates/thermite
388K /opt/pancfg/mgmt/reports/hruser-top-applications
384K /opt/pancfg/mgmt/reports/hruser-top-url-categories
384K /opt/pancfg/mgmt/reports/hruser-top-threats
360K /opt/pancfg/var
356K /opt/pancfg/var/lib
352K /opt/pancfg/var/lib/rpm
336K /opt/pancfg/mgmt/device-state
264K /opt/pancfg/mgmt/cms
244K /opt/pancfg/mgmt/cms/ssl
192K /opt/pancfg/home
164K /opt/pancfg/.keystore
144K /opt/pancfg/cfgdb
124K /opt/pancfg/mgmt/global/db
84K /opt/pancfg/mgmt/webui
80K /opt/pancfg/etc
72K /opt/pancfg/mgmt/webui/db
64K /opt/pancfg/mgmt/dstore
60K /opt/pancfg/opt
52K /opt/pancfg/opt/pan
44K /opt/pancfg/certificates/cac-ca-sec-4
44K /opt/pancfg/certificates/cac-ca-4
40K /opt/pancfg/mgmt/commitwarndb
36K /opt/pancfg/cache/gp
32K /opt/pancfg/opt/pan/content
32K /opt/pancfg/mgmt/dstore/snmp
32K /opt/pancfg/mgmt/cloud-appid
32K /opt/pancfg/etc/appweb
28K /opt/pancfg/session
28K /opt/pancfg/mgmt/wf_ramdisk
28K /opt/pancfg/mgmt/global/groups
28K /opt/pancfg/certificates/cac-ca-sec-4/0
28K /opt/pancfg/certificates/cac-ca-4/0
24K /opt/pancfg/tmp_mgmt_ngx
24K /opt/pancfg/session/pan
20K /opt/pancfg/mgmt/factory/pancerts
20K /opt/pancfg/home/fpi_jespanola
20K /opt/pancfg/etc/ha-ssh
20K /opt/pancfg/certificates/tmp
20K /opt/pancfg/certificates/ocsp-verify-ca-sec-4
20K /opt/pancfg/certificates/ocsp-verify-ca-4
16K /opt/pancfg/mgmt/wf_ramdisk/updates
16K /opt/pancfg/mgmt/warndir.11114
16K /opt/pancfg/mgmt/dstore/sslmgr
16K /opt/pancfg/mgmt/correlation
16K /opt/pancfg/mgmt/cms/v3
16K /opt/pancfg/mgmt/acedb
16K /opt/pancfg/html
16K /opt/pancfg/home/fpi_rvolante
16K /opt/pancfg/home/fpi_mbernardino
16K /opt/pancfg/home/fpi_localadmin
16K /opt/pancfg/home/fpi_dsolangon
16K /opt/pancfg/home/fpi_darrylg
16K /opt/pancfg/home/fpi_cgomez
16K /opt/pancfg/home/_cliuser
16K /opt/pancfg/home/Algosecanalysis
16K /opt/pancfg/home/Algosecactive
16K /opt/pancfg/certificates/reverse
16K /opt/pancfg/certificates/import
16K /opt/pancfg/certificates/device
16K /opt/pancfg/certificates/custom-4
16K /opt/pancfg/certificates/cache
12K /opt/pancfg/mgmt/urlblockdir
12K /opt/pancfg/mgmt/uploaded
12K /opt/pancfg/mgmt/sp
12K /opt/pancfg/mgmt/sec-conn-transforms
12K /opt/pancfg/mgmt/plugins
12K /opt/pancfg/mgmt/phpsessions
12K /opt/pancfg/mgmt/lcaas
12K /opt/pancfg/mgmt/factory/sysd-schema
12K /opt/pancfg/home/admin
12K /opt/pancfg/cache/useridd
12K /opt/pancfg/cache/mgmt
12K /opt/pancfg/cache/iotd
12K /opt/pancfg/cache/dscd
8.0K /opt/pancfg/session/pan/user_tmp
8.0K /opt/pancfg/mgmt/userid
8.0K /opt/pancfg/mgmt/usergroup
8.0K /opt/pancfg/mgmt/rawlog_fwd_hints
8.0K /opt/pancfg/mgmt/lcaas/ssl
8.0K /opt/pancfg/mgmt/global-protect
8.0K /opt/pancfg/mgmt/dstore/rasmgr
8.0K /opt/pancfg/mgmt/cloud-appid/global
8.0K /opt/pancfg/mgmt/cloud-appid/dp
8.0K /opt/pancfg/mgmt/cloud-appid/chunks
8.0K /opt/pancfg/home/root
8.0K /opt/pancfg/etc/ha-ssh/home
8.0K /opt/pancfg/etc/ha-ssh/export
8.0K /opt/pancfg/certificates/tmp/1
8.0K /opt/pancfg/certificates/ocsp
8.0K /opt/pancfg/certificates/custom-4/1
8.0K /opt/pancfg/certificates/crl
8.0K /opt/pancfg/cache/idmgr
4.0K /opt/pancfg/tmp_mgmt_ngx/uwsgi
4.0K /opt/pancfg/tmp_mgmt_ngx/scgi
4.0K /opt/pancfg/tmp_mgmt_ngx/proxy_temp
4.0K /opt/pancfg/tmp_mgmt_ngx/fastcgi
4.0K /opt/pancfg/tmp_mgmt_ngx/body
4.0K /opt/pancfg/tmp/sw-images
4.0K /opt/pancfg/tmp/plugins
4.0K /opt/pancfg/tmp/patch-images
4.0K /opt/pancfg/tmp/bootstrap-bundles
4.0K /opt/pancfg/session/pan/unknown
4.0K /opt/pancfg/session/pan/filters
4.0K /opt/pancfg/session/pan/csv
4.0K /opt/pancfg/plugins
4.0K /opt/pancfg/pan_slog
4.0K /opt/pancfg/opt/pan/wildfire
4.0K /opt/pancfg/opt/pan/plugins
4.0K /opt/pancfg/opt/pan/gpc
4.0K /opt/pancfg/opt/pan/av
4.0K /opt/pancfg/opt/content
4.0K /opt/pancfg/mgmt/wpc-images
4.0K /opt/pancfg/mgmt/wfm-images
4.0K /opt/pancfg/mgmt/wf_ramdisk/wildfire-images
4.0K /opt/pancfg/mgmt/wf_ramdisk/wf_tmp
4.0K /opt/pancfg/mgmt/wf_cloud_retries
4.0K /opt/pancfg/mgmt/wf-mini-reports
4.0K /opt/pancfg/mgmt/web-certificates
4.0K /opt/pancfg/mgmt/userid/tmp
4.0K /opt/pancfg/mgmt/usergroup/tmp
4.0K /opt/pancfg/mgmt/uploaded/sw-images
4.0K /opt/pancfg/mgmt/uploaded/patch-images
4.0K /opt/pancfg/mgmt/templates
4.0K /opt/pancfg/mgmt/template
4.0K /opt/pancfg/mgmt/sw-images
4.0K /opt/pancfg/mgmt/ssl
4.0K /opt/pancfg/mgmt/sp/vsys1
4.0K /opt/pancfg/mgmt/sp/shared
4.0K /opt/pancfg/mgmt/rawlog_fwd_hints/lr
4.0K /opt/pancfg/mgmt/plugins/pkginfo
4.0K /opt/pancfg/mgmt/plugins/appdata
4.0K /opt/pancfg/mgmt/plugin-images
4.0K /opt/pancfg/mgmt/patch-images
4.0K /opt/pancfg/mgmt/licenses
4.0K /opt/pancfg/mgmt/ipblockdir
4.0K /opt/pancfg/mgmt/groups
4.0K /opt/pancfg/mgmt/gpclient-images
4.0K /opt/pancfg/mgmt/gp-images
4.0K /opt/pancfg/mgmt/global/tmp
4.0K /opt/pancfg/mgmt/global/reguser
4.0K /opt/pancfg/mgmt/global/regip
4.0K /opt/pancfg/mgmt/global/authd
4.0K /opt/pancfg/mgmt/global-protect/av-data
4.0K /opt/pancfg/mgmt/export
4.0K /opt/pancfg/mgmt/dstore/satellite
4.0K /opt/pancfg/mgmt/dlcq
4.0K /opt/pancfg/mgmt/correlation/instdb
4.0K /opt/pancfg/mgmt/correlation/etc
4.0K /opt/pancfg/mgmt/correlation/backquery
4.0K /opt/pancfg/mgmt/commit-candidates
4.0K /opt/pancfg/mgmt/cloud-appid/taskfile
4.0K /opt/pancfg/mgmt/client-images
4.0K /opt/pancfg/mgmt/bootstrap
4.0K /opt/pancfg/mgmt/av-images
4.0K /opt/pancfg/html/2
4.0K /opt/pancfg/html/1
4.0K /opt/pancfg/html/0
4.0K /opt/pancfg/home/root/.ssh
4.0K /opt/pancfg/home/panorama
4.0K /opt/pancfg/etc/ssh
4.0K /opt/pancfg/etc/entropy_mp1
4.0K /opt/pancfg/etc/banner
4.0K /opt/pancfg/etc/appweb/ccdir
4.0K /opt/pancfg/customlogo
4.0K /opt/pancfg/certificates/tmp/2
4.0K /opt/pancfg/certificates/tmp/0
4.0K /opt/pancfg/certificates/reverse/2
4.0K /opt/pancfg/certificates/reverse/1
4.0K /opt/pancfg/certificates/reverse/0
4.0K /opt/pancfg/certificates/openssl
4.0K /opt/pancfg/certificates/ocsp/0
4.0K /opt/pancfg/certificates/ocsp-verify-ca-sec-4/3
4.0K /opt/pancfg/certificates/ocsp-verify-ca-sec-4/2
4.0K /opt/pancfg/certificates/ocsp-verify-ca-sec-4/1
4.0K /opt/pancfg/certificates/ocsp-verify-ca-sec-4/0
4.0K /opt/pancfg/certificates/ocsp-verify-ca-4/3
4.0K /opt/pancfg/certificates/ocsp-verify-ca-4/2
4.0K /opt/pancfg/certificates/ocsp-verify-ca-4/1
4.0K /opt/pancfg/certificates/ocsp-verify-ca-4/0
4.0K /opt/pancfg/certificates/import/2
4.0K /opt/pancfg/certificates/import/1
4.0K /opt/pancfg/certificates/import/0
4.0K /opt/pancfg/certificates/ike
4.0K /opt/pancfg/certificates/device/2
4.0K /opt/pancfg/certificates/device/1
4.0K /opt/pancfg/certificates/device/0
4.0K /opt/pancfg/certificates/custom-4/0
4.0K /opt/pancfg/certificates/crl/backup
4.0K /opt/pancfg/certificates/cache/2
4.0K /opt/pancfg/certificates/cache/1
4.0K /opt/pancfg/certificates/cache/0
4.0K /opt/pancfg/certificates/cac-ca-sec-4/3
4.0K /opt/pancfg/certificates/cac-ca-sec-4/2
4.0K /opt/pancfg/certificates/cac-ca-sec-4/1
4.0K /opt/pancfg/certificates/cac-ca-4/3
4.0K /opt/pancfg/certificates/cac-ca-4/2
4.0K /opt/pancfg/certificates/cac-ca-4/1

admin@InnoLabPA440> show system files

/var/cores/:
total 4.0K
drwxr-xr-x 2 root root 4.0K May 7 2024 crashjobs

/var/cores/crashjobs:
total 0

/opt/panlogs/cores/:
total 4.0K
drwxr-xr-x 2 root root 4.0K May 7 2024 crashinfo

/opt/panlogs/cores/crashinfo:
total 0

[mshekh]

Hi @NickoKristian ,

Please follow the instructions to clean the partition in kb article, removing the core files will not have service impact.

High Disk Space Usage on / root partition and How To Clear

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS

Best Regards,

Mohammad Talib