000037363 - Boot partition 100% full after upgrade to RSA NetWitness Logs & Network 11.3.0

Document created by RSA Customer Support Employee on Apr 16, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037363
Applies ToRSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.3.0
Platform: CentOS
O/S Version: 7
IssueAfter upgrading from RSA NetWitness 11.x to 11.3.0 the /boot partition shows as being 100% full.
CauseThis issue is caused by older kernels not being removed once they are no longer useful. If the customer upgraded from 11.0  > 11.1 > 11.2 > 11.3.0 the total number of kernels will fill the /boot partition.
ResolutionTo resolve this issue several of the older kernels will need to be removed. Any NetWitness  Log & Network server can be affected by this issue. Please run the command below on any server that has the /boot partition full due to kernels. You may also run this command before installing 11.3.0 to help keep  the /boot partition from filling once it installs the latest kernel.
  1. Log into the server with an SSH client.
  2. Run the following command at the command prompt. It will remove all kernels except for the two most recent kernels.

package-cleanup --oldkernels --count=2 -y

  1. Check the free space for /boot by running the df -h command.

df -h

If the issue persists after running the commands above, please contact RSA Customer Support.

NOTE: This issue only affects RSA NetWitness 11.3.0. The issue will be fixed in and above.