/pfs partition is 100% full

Products

• Security Analytics
• Security Analytics - VA

Issue/Introduction

When looking at the output of 'df -h' from the command line, the /pfs partition is 100% full.  

/etc/solera/flows is also showing 100% full

 

Resolution

The configuration of the capture file system requires that all of the space be pre-allocated.  Even if the system is brand new and has not captured any traffic, the /pfs partition will show 100% usage.  This is normal and does not mean that all of the space is used up.  Once the appliance determines it has used up all of the pre allocated space, it will begin to overwrite the oldest data first.  

For more information on this file system and others that may be higher than expected, see this knowledge base article: /pfs and and /var/lib/solera/meta filesystems showing very full