Forward Node NSM Disk 100% and can't boot.

[rigbyst]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

200GB

Storage for /

9 TB

Storage for /nsm

8 TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I have a forward node where the Disk filled up and now won't boot. I can use the Rocky recovery cd to boot in rescue mode and then delete files. Is there a better way? Does the SO install CD have a recovery option?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[eb-op]

rigbyst,

The SO install ISO does include the option to rescue a Security Onion system.

[rigbyst]

Thank you. I was able to delete some files. It now seems to crash every 20-30 minutes. Penty of disk... No errors that I can see.

[dougburks]

@rigbyst You'll need to provide more information if you'd like us to help you.

I was able to delete some files.

What exactly did you delete?

It now seems to crash every 20-30 minutes.

What exactly is crashing? A particular service or the entire OS?

If it's a particular service, have you checked logs in /opt/so/log/ for additional clues?

If it's the entire OS, have you run full diagnostics on your hardware to make sure it's not a hardware issue?

[rigbyst]

Thanks for the response Doug! I deleted some of the pcap files in /nsm. After some investigating the Host OS (HyperV) disk the Security Onion VM was running on didn't have enough free space and was causing the issue.
Thanks for your time!

[rigbyst]

Disk space on the host os did not have enough space for Security onion to work.