C Partition Keeps Getting Full

[Kay Hamling]

Hiwe keep receiving email alerts telling us the root partition is filling up and that it's 86%. Not seeing anywhere close to 86% being used up, even after rebooting. Any ideas on why we are getting this alert even though the disk seems to be fairly empty?

Hi Bob, thanks for the response! So I've had similar issues in the past with up2date filling things up, but I'm unclear as to why the dashboard (as shown in the screenshot in my OP) doesn't show high utilization. Is the root partition just not reflected there?

Anyway, I currently have two identical sg230 HA pairs in different locations. They are both on 9.358-3 and both show "10 update(s) available for installation" on their dashboards. However I'm only getting the aforementioned alerts on one of them. Interestingly, on that one, if I go to the up2date screen, it says that "your firmware is up to date" and that there are no packages available for installation. I assume this is because it thinks it's too full to unpack the updates. What I don't understand is why this identically configured one with the same firmware and supposedly the same 10 downloaded updates would be fuller than the other one.

I have to say given the number of times I run into stuff like this (and based on how many hits there are about others having similar issues) it sure seems like Sophos could come up with a better way to handle things.

I followed the sophos kb to get in and delete the up2date files, but even after clearing sys and sys-install and .queue there is still 2.8G being eaten up on the problem SG230's sda6 (57% full). I'm unclear on how to track down what is stored there. I rebuilt the postgresql DB and deleted the old dumps in the cores folder so my large file output is:

Kind of at a loss as to how to figure out what is being stored on sda6 and how to clear it ,but I suppose the patterns differential (650+ megs) is maybe enough to push the problem one into the danger zone, hence the warnings on one and not the other.

I figured maybe it wanted a blank disk, so I used diskpart to remove the partitions and tried again. Got the same error. Tried diskpart again and added the clean command after everything else. Tried the restore again got the same thing again. Did the same with a totally different SSD from another active system that is getting a bigger ssd. Same result and diskpart process.

Let say firewall is running in 9.0.6, If we want to upgrade to 9.0.8 we are unable to proceed because the root partition is full and software manager is not able to download the PANOS maintenance image file.

There are separate partitions for logs, cfg, repo, etc but the root partition holds all the temporary stuff like software version package being downloaded and extracted, packet captures and dataplane-debug files, tech support files, etc, so if it is full you'll not be able upgrade.

Even I free up I can able to free up only 100MB which is like 2 to 3% so resulting root space is 89% and available root space is around 300MB, most the maintenance version are having 400 plus MB file which is not getting installed in root as the partition is already about to fill and it not having sufficient space to install firmware.

There are some lesser known files in there (/) that could take up some space, for example if a debug flow-basic was taken and not cleared. Also the Daily reports (Monitor->Reports) sit there and accumulate over time.

When support logs in with Root Access, does the network stop passing traffic through the Firewall? Asking because I need to know whether to schedule a maintenance window or if I can do this during production.

Well, DERP, forgot about grub. Spent a loooooong time getting those commands entered correctly,. Not sure how the whole directory structure works when deleting partitions. Example: does former dev/sdc1 become sdb1? Of course, hard to tell in grub as we are using (HD2,2), etc.

So once I got grub fixed, booted up, grub remains, and Ubuntu is top choice. Hmmm, had that happen yesterday (after a hard reboot after system freeze) where instead of Linux Mint and Ubuntu, I had Ubuntu ver.xx.x and Ubuntu verxx.x but later it corrected itself and showed Linux Mint and Ubuntu.

Not sure if I am thinking right, but once i deleted the partition, when I resized the other, it started after the deleted partition. But in gparted, as I grew the remaining partition, the deleted one shrunk accordingly, even though it was before it. So is it possible that I deleted the right partition (Kubuntu) and added it to LM, but setting the particular vmlinuz-6.5.0-15-generic and maybe pointing to the wrong /dev/sd? I made grub now only show booting to the Kubuntu kernel or is that even possible?

After getting to the point in Testdisk that I am unsure (and we all know not to do ANYTHING in Testdisk till we are sure) I searched ITSFOSS for relative info and did find a good thread from 2019, but ALAS it never got a solution.

So while awaiting the restoration of high speed internet (vs. my cell phone hot spot) I will wait and hope that someone here can assist me. Ever the optimist, if it cannot be done, I will resinstall and count this as furthering my Linux education.

That is right. You need Clonezilla backups made with a Clonezilla usb drive. Then you can use the usb drive to start Clonezilla for a restore. Your backup software needs to be on an independent medium.

I was rather hoping to restore from Testdisk as I am afraid doing anything will wipe the recently deleted partition when it is actually still there, since I have not done one thing other than fix grub in grub shell today on that machine.

But I just read that timeshift CAN be used to restore a non-bootable system via live USB. BUT the issue remains: are the snapshots on that same partition I deleted? I do know you cannot use an external usb for the snapshots as believe me I tried.

Apparently my attempts in the past to have Timeshift use my ext HDD must have been user error as it is capable of doing so. Here is the guide for restore:

Snapshots can be restored either from the running system (online restore) or from a live CD (offline restore). Restoring backups from the running system requires a reboot to complete the restore process.

I thought you could not boot anything.

If you can boot Kubuntu, temporarily make it the grub controller with grub-install, enable os-prober, then do update-grub, and reboot, and the grub menu should display everything that is there.

Why would we do this when grub already booted with Kubuntu and all the memtest, etc. options? Would grub have not found LM then? Although, I am stumped why there was a grub in the 1st place with only one OS. Unless it was my doing in the grub shell after it would not boot at all.

I am not positive it will work, but I did find my LM snapshots on the external HDD from October. Reason I am unsure, is I had read some forums where copying the snapshots did not work and I must have copied the folders of snapshots from the internal OS partitions to the external drive.

I will need to boot LM from my Ventoy, install Timeshift on the drive and run it to test

a) what it finds on the current internal drive (that includes the deleted partition) as well as

b) point to that external HDD and see if those are recoverable.

LOL...I have been to Cleveland. We drove through a couple of summers ago when we were headed out East for vacation. My husband also has a client there and loves it. We did hit a couple of good restaurants there and loved the cute waterfront area there.

ha! That's awesome, it is a great city to stop in with a variety of things to do. Good food is a hobby for me here, so if you are ever in the area (with your husbands client, etc) and want recommendations feel free to hit me up! Best pho and frites fried in duck fat ever, among soooo much else, haha

My name is Nicole Behnke. I am the Senior Manager, Marketing Operations at PowerSchool (a SaaS software company for Ed Tech). I have been in marketing automation for over 10 years, and use Marketo on a daily basis. I worked in many marketing automation platforms and Marketo is the best. I am looking forward to getting certified and gaining a deeper knowledge of Marketo.

Welcome Nicole! Sounds like you and I have similar experience, love that you've been working in the platform for so long! I hope to help you round out any areas of knowledge you feel you could use mentorship in - looking forward to it!

A lot of these points can depend on how the organization you work with has implemented the product - With it being a smaller part of the exam, you don't have to worry about being too in-depth here, but it's good to have a basic knowledge of how everything is plugged in, mapped and monitored - which is more along the knowledge level this exam is looking for.

Check out the prep guide for this week and if you have any areas above you want to make sure are covered, let me know here. I'll post our first prep question related to the above on Friday - good luck, and let's get going!

All of these docs can be found within sections from the first part of the Exam Prep Guide which guides you through step by step. As a reminder, we get to nominate mentees for perks, so give these questions a shot and let me know what you're most interested in focusing on learning more about!

No worries! Last week was a holiday and some countries had elections, etc so there were a lot of slow starts - there's a practice test at the end and I'm here to answer any questions you have along the way so hopefully you can get what you need out of it!

1 & 2 are correct, great work! 3 is A as the correct answer. Email deliverability is set in admin and monitored in UI/in additional products - so it is not tied to workspaces or partitions like that. I like to think of Partitions as hard walled containers for the people data that lives in Marketo, and Workspaces as soft walls for the data, but functions as hard walls for your assets and user permissions, and is how you manage that within Marketo.

3a8082e126