Detection server installation on Linux fails due to insufficient disk space - installing package symantec-dlp-* needs XXXMB on the / filesystem

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Monitor and Prevent for Email
• Data Loss Prevention Network Monitor and Prevent for Email

Issue/Introduction

When running install.sh to install a Detection server ("-t detection" parameter) on a Linux system it fails with the following, or similar, message:

 

Preparing...                          ################################# [100%]

        installing package symantec-dlp-16-0-00000-content-extraction-plugins-16.0.00000-60853.x86_64 needs XXXMB on the / filesystem

 

The installation stops at this point.

Environment

DLP 15.8 or later

Cause

This is a Linux RPM native message which indicates that the disk space on the filesystem specified in the warning is insufficient. The amount of MB (XXXMB) displayed is how much more is needed to finish the installation successfully.

Resolution

1. Identify the affected filesystem in the message. The name of the filesystem is provided in the message between "on the" and "filesystem".

installing package symantec-dlp-16-0-00000-content-extraction-plugins-16.0.00000-60853.x86_64 needs XXXMB on the / filesystem

In this particular example the space is lacking on the "/" which is the root filestystem.

2. To identify the specific filesystem in Linux and to determine what is it's current capacity run the following command:

df -h

The output of the command will look similar to the one below:

[root@detection /]# df -h
Filesystem             Size  Used Avail Use% Mounted on
overlay                192G  131G   62G  69% /
tmpfs                  5.8G     0  5.8G   0% /dev
tmpfs                  5.8G     0  5.8G   0% /sys/fs/cgroup
/dev/mapper/rhel-root  192G  131G   62G  69% /etc/hosts
shm                     64M     0   64M   0% /dev/shm
tmpfs                   64M  684K   64M   2% /run
tmpfs                   64M     0   64M   0% /run/lock
tmpfs                   64M     0   64M   0% /var/log/journal
tmpfs                  5.8G  648M  5.2G  11% /tmp

In this example running the Detection server installation would not run into any issues and throw the presented warning message as there is plenty of space available. It is provided only as an example on how to identify the problematic filesystem. In this particular example the root "/" (overlay) filesystem has 192 GB, 131GB are used and 62% GB are available. It is used up in 69%. 

3. Once the filesystem with insufficient space is identified it is necessary to expand it by allocating more disk space. For details on the process refer to Linux system administration guides.

Note that the given filesystem may need to be expanded further than the amount of MBs provided in the warning message. Consider an overhead to accommodate other packages.