After upgrading from RSA NetWitness 11.x to 11.3.0 the /boot partition shows as being 100% full.
This issue is caused by older kernels not being removed once they are no longer useful. If the customer upgraded from 11.0 > 11.1 > 11.2 > 11.3.0 the total number of kernels will fill the /boot partition.
To resolve this issue several of the older kernels will need to be removed. Any NetWitness Log & Network server can be affected by this issue. Please run the command below on any server that has the /boot partition full due to kernels. You may also run this command before installing 11.3.0 to help keep the /boot partition from filling once it installs the latest kernel.
Log into the server with an SSH client.
Run the following command at the command prompt. It will remove all kernels except for the two most recent kernels.
package-cleanup --oldkernels --count=2 -y
Check the free space for /boot by running the df -h command.