RSA Netwitness 10.6 to 11.3 -u backup failing due to not enough space

[PatrickMclean]

Hi RSA Forum,

I got a question regarding the backup from 10.6 to 11.3 with the -u switch. Its mentioned multiple time not to change the backup path to anything other than the default. Id like to know the reason for this as my backup is currently failing due to not enough space within that default directory.

See below

I need a couple more gigs within that for the backup to actually complete successfully.

Calculating size of backup for hostname
Disk space required for hostname backup is 13.80GB

all my other hosts have enough space and finish without issue. Rather than attempting to use shrink another partition in order to grow this one. It makes more sense to just hold the backup in another directory for this host then when upgrading this host reference the non-default directory i used for this host.

The consistent references within 10.6.6 to 11 upgrade documentation to only use the default directory make me think that this approach would not work.

Any advice on the best way to move forward would be appreciated

Thanks,

[DesmondKwang · Accepted solution]

An alternative will be to reduce the backup size by clearing core files and nwtech files which could have generated and existed in the host over the years.

[PatrickMclean]

HI Desmond,

Thanks for this response. Unfortunately I'm not seeing hardly anything in regards to the nwtech outputs to remove to reduce the space. Do you have any examples regarding core files i could remove in order on a series 4s log hybrid that will further reduce the space that the backup needs?

Thanks,

[JohnSnider]

could I get some additional information about the host?

What type of device (decoder, concentrator, etc.) is it?

Is it a Virtual machine?

Can you post a "df -h" of from the host

[PatrickMclean]

Hi John,

Its a log hybrid. so it will be log collector, log decoder, log concentrator

It is an actual series 4s appliance.

Let me know if you need anything else.

[JohnSnider]

Looks like the issue may be with the /var/netwitness/logcollector directory, 

du -sh /var/netwitness/logcollector/*

See what is using the 14G in there, if that is not it, then run the following and post results

du -sh /var/netwitness/*

du -sh /home/*

du -sh /root/*

See if there are any big files that shouldn't be there,

[DesmondKwang]

Command:

# find /var/netwitness/ -name core*

Sample of core files:

If required, seek permission from owner before you remove the core files.