FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
nsoni
Staff
Staff
Article Id 408325
Description This article provides step-by-step instructions to safely clean up old kernel versions from the /boot partition.
Scope FortiSIEM.
Solution

Pre-requisites.

  1. Verify the running kernel version:

 

uname -sr

 

Example output: Linux 4.18.0-513.11.1.el8_9.x86_64.

 

  1. List installed kernel packages:

 

rpm -q kernel

 

Example output:


kernel-4.18.0-513.9.1.el8_9.x86_64
kernel-4.18.0-513.11.1.el8_9.x86_64
kernel-4.18.0-513.24.1.el8_9.x86_64

 

  1. Take a snapshot of the VM before proceeding with the cleanup steps. It is a must.

 

Cleanup Steps.

Remove older kernel versions.
Use the following command to remove older kernels, keeping only the latest two:


yum remove $(yum repoquery --installonly --latest-limit=-2 -q)

 

Important Note:
Before confirming the removal, verify that the output includes all three components of the same kernel version:

  • Kernel.
  • Kernel-core.
  • Kernel-modules.

 

Example output:


Removing:
kernel x86_64 4.18.0-513.9.1.el8_9 @baseos
kernel-core x86_64 4.18.0-513.9.1.el8_9 @baseos
kernel-modules x86_64 4.18.0-513.9.1.el8_9 @baseos

If the versions match and are not the currently running kernel, press y to confirm.

 

Post-Cleanup Verification.

  1. Recheck installed kernels:

 

rpm -q kernel

 

  1. Ensure the current kernel is still installed:


uname -r

 

  1. Reboot to verify system stability:


reboot