Troubleshooting Tip: FortiDDoS-F full disk space

Description

This article describes how to troubleshoot and recover from a full disk condition on a FortiDDoS-F appliance. High disk utilization may affect system performance and prevent normal operation of logging services.

Scope

FortiDDoS-F.

Solution

In old versions, lower than v7.0.4, there was a bug #1089446 that impacted disk space:

• Resolved issues (FortiDDOS-F v7.0.4).

• Upgrade notes (FortiDDOS-F v8.0.0).

1. As a best practice for FortiDDoS-F, keep the device running the latest supported firmware. The most recent patch releases include the highest number of bug fixes and security vulnerability remediations and are generally considered the most stable. Firmware updates are released periodically to introduce new features and address critical issues. Maintaining an up-to-date FortiDDoS deployment helps ensure optimal performance, stability, and security.

2. Before upgrading to the firmware versions that include the fix for this issue, sufficient disk space must be made available on the FortiDDoS appliance. Failure to do so may prevent the upgrade from completing successfully.

Attempt to free up disk space (Log Purge): Old logs can be manually removed from Log & Report -> Log Purge Settings. Review and purge older logs and verify that the disk space.

Take a backup and clear crash logs: open an SSH session to the FortiDDoS appliance (using PuTTY or another SSH client). Log in with the superadmin credentials and run the following commands, then verify disk utilization and perform the upgrade.

rm -f /home/backup_config_file/geoip/geoip*
rm -f /var/log/geoip*
rm -f /var/log/crash/*
rm -f /var/log/backup_crash/*
df -h
fnsysctl df -h

Note: If disk utilization remains high after purging logs and clearing crash files, open a support case with TAC. See Customer Service Tip: How to create a ticket for Fortinet TAC.

Additional troubleshooting may be necessary to remove files that are consuming excessive disk space.