﷽
On Palo Alto Networks firewalls, a 100% full /opt/pancfg partition is a known critical issue and can break commits, upgrades, and logging. Your output shows exactly that:
rizky@PANOS> show system disk-space
Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p3 32G 6.8G 23G 23% /
none 16G 72K 16G 1% /dev
/dev/nvme0n1p5 63G 62G 1G 100% /opt/pancfg
So here is the quickfix, first of all always backup before performing any changes in the configuration :
rizky@PANOS> config
rizky@PANOS# save config to RIZKY-CONFIG
Config saved to RIZKY-CONFIG
[edit]
1) Check disk space, specifically /opt/pancfg :
rizky@PANOS> show system disk-space
Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p3 32G 6.8G 23G 23% /
none 16G 72K 16G 1% /dev
/dev/nvme0n1p5 63G 62G 1G 100% /opt/pancfg
/dev/nvme0n1p6 32G 7.9G 22G 27% /opt/panrepo
tmpfs 16G 5.6G 9.9G 36% /dev/shm
cgroup_root 16G 0 16G 0% /cgroup
/dev/nvme0n1p8 267G 25G 228G 10% /opt/panlogs
2) Enable Aggressive Log Cleaning :
rizky@PANOS> debug software disk-usage aggressive-cleaning enable
This will automatically purge all old log files if disk hits 95% occupancy. Do you accept this potential loss of debuggability? (y or n) y
Verify :
rizky@PANOS> show system state | match aggressive-cleaning
cfg.debug-sw-du.config: { 'aggressive-cleaning': True, }
3) Enable deep cleaning at 90% :
rizky@PANOS> debug software disk-usage cleanup deep threshold 90
3) Clean unused/old update :
rizky@PANOS> debug pancfg-directory-usage clean
> config Clean unused saved configurations
> dynamic-updates Clean unused dynamic updates
> software-images software-images
Clean old backup config :
rizky@PANOS> debug pancfg-directory-usage clean config saved
DEFAULT 2024/02/10 10:01:23 2176.8K
DEFAULT-10FEB2024 2024/02/10 10:01:33 2176.8K
PaloAlto-3010-17JAN24-LB 2024/01/17 19:20:08 2032.8K
PaloAlto-3010-17JAN24-LB-PRD 2024/01/17 19:45:14 2029.4K
PaloAlto-3010-17JAN24-LBNET 2024/01/17 19:42:49 2033.2K
autosave-10.2-20230728.xml 2023/07/28 14:32:09 1823.0K
<value> Filename
rizky@PANOS> debug pancfg-directory-usage clean config saved PaloAlto-3010-17JAN24-LB
Clean old anti-virus update :
rizky@PANOS> debug pancfg-directory-usage clean dynamic-updates anti-virus update panup-all-antivirus-xxxx-xxxx.tgz
successfully removed panup-all-antivirus-xxxx-xxxx.tgz
Clean old content update :
rizky@PANOS> debug pancfg-directory-usage clean dynamic-updates content update panupv2-all-contents-xxxx-xxxx.tgz
successfully removed panupv2-all-contents-xxxx-xxxx.tgz
Clean old software update :
rizky@PANOS> debug pancfg-directory-usage clean software-images version 10.x.x-hxx
Successfully removed image
Barakallahu fiikum,
Wa jazakumullahu khair.
