AnsweredAssumed Answered

RSA Netwitness 10.6 to 11.3 -u backup failing due to not enough space

Question asked by Patrick Mclean on Feb 25, 2020
Latest reply on Feb 25, 2020 by Desmond Kwang

Like • Show 0 Likes0
Comment • 6

Hi RSA Forum,

I got a question regarding the backup from 10.6 to 11.3 with the -u switch. Its mentioned multiple time not to change the backup path to anything other than the default. Id like to know the reason for this as my backup is currently failing due to not enough space within that default directory.

See below

I need a couple more gigs within that for the backup to actually complete successfully.

Calculating size of backup for hostname
Disk space required for hostname backup is 13.80GB

all my other hosts have enough space and finish without issue. Rather than attempting to use shrink another partition in order to grow this one. It makes more sense to just hold the backup in another directory for this host then when upgrading this host reference the non-default directory i used for this host.

The consistent references within 10.6.6 to 11 upgrade documentation to only use the default directory make me think that this approach would not work.

Any advice on the best way to move forward would be appreciated

Thanks,

Desmond Kwang

Feb 25, 2020 12:20 PM

Correct Answer

An alternative will be to reduce the backup size by clearing core files and nwtech files which could have generated and existed in the host over the years.

See the reply in context

No one else had this question

Outcomes

Desmond Kwang

Feb 25, 2020 12:20 PM

An alternative will be to reduce the backup size by clearing core files and nwtech files which could have generated and existed in the host over the years.

Actions

Patrick Mclean @ Desmond Kwang on Feb 25, 2020 1:15 PM

HI Desmond,

Thanks for this response. Unfortunately I'm not seeing hardly anything in regards to the nwtech outputs to remove to reduce the space. Do you have any examples regarding core files i could remove in order on a series 4s log hybrid that will further reduce the space that the backup needs?

Thanks,

Actions

Desmond Kwang

@ Patrick Mclean on Feb 25, 2020 7:49 PM

Command:

# find /var/netwitness/ -name core*

Sample of core files:

If required, seek permission from owner before you remove the core files.

Actions

John Snider

Feb 25, 2020 1:28 PM

could I get some additional information about the host?

What type of device (decoder, concentrator, etc.) is it?

Is it a Virtual machine?

Can you post a "df -h" of from the host

Actions

Patrick Mclean @ John Snider on Feb 25, 2020 1:34 PM

Hi John,

Its a log hybrid. so it will be log collector, log decoder, log concentrator

It is an actual series 4s appliance.

Let me know if you need anything else.

Actions

John Snider

@ Patrick Mclean on Feb 25, 2020 2:08 PM

Looks like the issue may be with the /var/netwitness/logcollector directory,

du -sh /var/netwitness/logcollector/*

See what is using the 14G in there, if that is not it, then run the following and post results

du -sh /var/netwitness/*

du -sh /home/*

du -sh /root/*

See if there are any big files that shouldn't be there,

Actions

6 Replies

Desmond Kwang Feb 25, 2020 12:20 PM
Unmark Correct
Correct Answer
An alternative will be to reduce the backup size by clearing core files and nwtech files which could have generated and existed in the host over the years.
Like • Show 0 Likes0
Actions
- Patrick Mclean @ Desmond Kwang on Feb 25, 2020 1:15 PM
  Mark Correct
  Correct Answer
  HI Desmond,
  
  Thanks for this response. Unfortunately I'm not seeing hardly anything in regards to the nwtech outputs to remove to reduce the space. Do you have any examples regarding core files i could remove in order on a series 4s log hybrid that will further reduce the space that the backup needs?
  
  Thanks,
  Like • Show 0 Likes0
  Actions
  - Desmond Kwang @ Patrick Mclean on Feb 25, 2020 7:49 PM
    Mark Correct
    Correct Answer
    Command:
    # find /var/netwitness/ -name core*
    
    Sample of core files:
    
    If required, seek permission from owner before you remove the core files.
    Like • Show 0 Likes0
    Actions
John Snider Feb 25, 2020 1:28 PM
Mark Correct
Correct Answer
could I get some additional information about the host?
What type of device (decoder, concentrator, etc.) is it?
Is it a Virtual machine?
Can you post a "df -h" of from the host
Like • Show 0 Likes0
Actions
- Patrick Mclean @ John Snider on Feb 25, 2020 1:34 PM
  Mark Correct
  Correct Answer
  Hi John,
  
  Its a log hybrid. so it will be log collector, log decoder, log concentrator
  It is an actual series 4s appliance.
  Let me know if you need anything else.
  Like • Show 0 Likes0
  Actions
  - John Snider @ Patrick Mclean on Feb 25, 2020 2:08 PM
    Mark Correct
    Correct Answer
    Looks like the issue may be with the /var/netwitness/logcollector directory,
    du -sh /var/netwitness/logcollector/*
    
    See what is using the 14G in there, if that is not it, then run the following and post results
    
    du -sh /var/netwitness/*
    du -sh /home/*
    du -sh /root/*
    
    See if there are any big files that shouldn't be there,
    Like • Show 0 Likes0
    Actions

RSA Netwitness 10.6 to 11.3 -u backup failing due to not enough space

Outcomes

Related Content

Recommended Content