This is a quick guide on how to resolve an occasional problem that could happen to neglected Sophos UTM firewall with default settings, where updates are automatically download to device, filling up storage after some time.
An email alert similar to the below is sent to administrator when it happens:
To solve it, one way is to
From: Firewall Notification System [firstname.lastname@example.org]
Sent: 18 June 2016 11:58 PM
To: Administrator [email@example.com]
Subject: [SOPHOS][INFO-150] Root partition is filling up - please check
Root partition is filling up - please check. Current usage: 86%
System Uptime : 362 days 1 hour 2 minutes
System Load : 0.05
System Version : Sophos UTM 9.210-20
Please refer to the manual for detailed instructions.
- SSH into Sophos UTM firewall using root login
- Remove content under Sophos update directory (Main focus of this blog post)
- (Optional) Configure firmware download interval for System Up2Date packages from Automatic to Manual
1. SSH into Sophos UTM firewall using root with public key authentication
In order for root login to be made possible, it is required to first generate a private key and set up public key authentication. You may refer to any guide found on the Internet such as this one.After enabling root login, we can then authenticate using the private key file using SCP/SSH clients such as WinSCP, PuTTy by specifying private key file as shown below.
a. Specifying private key file in WinSCP SCP client:
b. Specifying private key file in PuTTy SSH client:
2. Remove content under Sophos update directory
Commands for determining storage utilization on directory /var
- cd /var
- du -shx *
After root SSH login, executing the above directory size checking commands revealed the /var/up2date folder (containing downloaded firmware updates) took 2GB of space on the device.
Mitigate the situation by removing the update files under /var/up2date/sys. Below screenshot shows a way to do it using WinSCP. (Backing up the files is recommended prior to deletion.)
Command for listing space utilization statistics on each file system mounted on device
- df -h
Before removing the files, the disk utilization was 86%:
After removing the files, the disk utilization lowered to 46%:
3. Configure download interval for System Up2Date packages as Manual
To prevent this problem from recurring, firmware download interval can optionally been set to Manual on the firewall. After configuring the setting, firewall updates will not be automatically downloaded, hence device storage won’t be filled up as easily.
Hope this post provides a quick way to resolve this problem for those who encounter it.
Root partition filling up…
let's find where the problem is, from the command line as root:
du -shx *
And then go into the largest in the list and do du -shx * again.
It looks like you're now on 9.318, so I would set the Download interval to "Manual" and delete everything in /var/up2date/sys