Palo Alto Software Download Failure

I had an error on my PA-200 with PAN-OS 7.0.5 while trying to download a new firmware version. “Error: There is not enough free disk space to complete the desired operation. […]”. Even the tips to delete older software, dynamic updates, etc., and to use the “set max-num-images count” command did not lead to a successful download.

Finally, the TAC support could solve the problem via root access to the Palo Alto firewall and by manually moving data files…

This was the disk space on the firewall before the TAC support corrected it (note the 5th line with 92 % usage):

And on my monitoring server I could see that the management config partition increased its usage a few weeks ago:

Palo Alto disk space 03 Management Config Partition

The supporter now used the  debug tac-login challenge  and  debug tac-login response  commands to gain root access on my PA-200. (Interesting…) He said that the problem is due to not deleted AV- and content-packages. He then did the following steps:

  1. He navigated to the folder in which the AV and content packages reside.
  2. He moved the “newav” folder to another partition. Now there was enough disk space on the current partition.
  3. Via the GUI, he upgraded the content packages. This worked and PAN-OS correctly deleted the temporary content files.
  4. He then moved back the AV files (newav) to the original partition
  5. and upgraded the AV packages appropriately. This worked, too, and PAN-OS correctly deleted the temporary AV files, too.

Now the usage of /dev/sda5, mounted on /opt/pancfg, was about 73 %:

This is the daily graph of the management config partition which shows the decrease of the space usage during the support call:

Palo Alto disk space 04 Management Config Partition during Support Case

After this procedure, I was able to update man PAN-OS to a newer version. Thank you. And hopefully this bug will be fixed in an upcoming version! (Bug number 94106.)

[UPDATE]

After I ran into this issue one more time, I received an answer from the Palo Alto Support with the following link: https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Free-Up-Disk-Space-in-PAN-OS-5-0/ta-p/63151. And in fact, after deleting some files etc., the download of new dynamic updates worked again. This link was also sent to me by the support, but I did not need it here: https://live.paloaltonetworks.com/t5/Management-Articles/How-and-When-to-Clear-Disk-Space-on-the-Palo-Alto-Networks/ta-p/55736.

These are the commands I used in my case. The usage of /opt/pancfg decreased from 92% to 86%:

My monitoring system shows the decrease of the disk usage as well as a successful installation of antivirus patterns at 5 am:

Palo Alto disk space 06 after manually deleting one day

Featured image “Kleines Missgeschick” by Dave Durden is licensed under CC BY-NC-ND 2.0.

3 thoughts on “Palo Alto Software Download Failure

  1. Hello,
    I have problem with my PAN:

    /dev/sda3 1.9G 1.5G 393M 91% /

    I think this is cause make my PA become so slow

    Do you know how to clear this partition?

    Thanks

  2. I know this problem and for myself i have another solution. I go in Maint Mode an do a Factory Reset. All old files will be deleted and i can install new software.

    BR
    Sascha

Leave a Reply

Your email address will not be published. Required fields are marked *