Cisco ISE 1.2 disk space

Our internal filesystem keeps growing. Should I be worried?
It's now
show disks
disk repository: 6% used (756804 of 14877092)
Internal filesystems:
/ : 66% used ( 109660140 of 177740076)
/storedconfig : 7% used ( 5690 of 93327)
/tmp : 2% used ( 35952 of 1976268)
/boot : 15% used ( 68215 of 489956)
/dev/shm : 0% used ( 0 of 1956256)
all internal filesystems have sufficient free space

All the reading seem to be in normal range nothing to worry about now
just for reference
http://www.cisco.com/c/en/us/td/docs/security/ise/1-1-1/installation_guide/ise_install_guide/ise_vmware.pdf

Similar Messages

Cisco ISE - Reauthentication of client if server becomes alive again

Dears,
I have this case where Cisco ISE server is used to authenticate & authorize clients on the network.
I configured the switch port to authorize the client in case the ISE server is dead (or not reachable).
The thing is that I want to reauthenticate the client once the ISE server becomes alive again but I am not able to.. ("Additional Information is needed to connect to this network" bullet is not appearing and the client PC remains authenticated and assigned to the VLAN.
Below is the switch port configuration:
interface FastEthernet0/5
switchport access vlan 240
switchport mode access
switchport voice vlan 156
authentication event server dead action authorize vlan 240
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
spanning-tree portfast
Anyone can help?
Regards,

Please check whether the switch is dropping the connection or the server.
Symptoms or Issue
802.1X and MAB authentication and authorization are successful, but the switch is dropping active sessions and the epm session summary command does not display any active sessions.
Conditions
This applies to user sessions that have logged in successfully and are then being terminated by the switch.
Possible Causes
•The preauthentication ACL (and the subsequent DACL enforcement from Cisco ISE) on the NAD may not be configured correctly for that session.
•The preauthentication ACL is configured and the DACL is downloaded from Cisco ISE, but the switch brings the session down.
•Cisco ISE may be enforcing a preposture VLAN assignment rather than the (correct) postposture VLAN, which can also bring down the session.
Resolution
•Ensure the Cisco IOS release on the switch is equal to or more recent than Cisco IOS Release 12.2.(53)SE.
•Check to see whether or not the DACL name in Cisco ISE contains a blank space (possibly around or near a hyphen "-"). There should be no space in the DACL name. Then ensure that the DACL syntax is correct and that it contains no extra spaces.
•Ensure that the following configuration exists on the switch to interpret the DACL properly (if not enabled, the switch may terminate the session):
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send accounting
radius-server vsa send authentication

ISE VM install question related to Disk Space on VMDK

Hi all, and thanks in advance for any help/advice you can offer.
We recently licensed for 10 ISE VM instances in our environment. We are trying to install the 3945 OVA file and it is forcing us to allocate 600GB for the appliance in the VMDK. Per the install guide, however, the PSN only requires 200GB of disk space. This install will be for a PSN persona eventually, once its built and added to a deployment. So do we have to burn 400Gb for this? I am being told by the VM team that once the 600GB is allocated in the VMDK, it will not be able to be changed later to 200GB. I am told it can expand, but there is no option to shrink the disk size to 200GB. Almost seems as though the OVA should have been made to require a 200GB partition, then you could expand that to 300GB for Admin persona's and more for Monitoring persona's. As it stands, without the option to shrink the drive size, we are wasting 400GB unless I am missing something. Thus I am asking for your help!
Install guide where VM disk sizing is specified is located at:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/installation_guide/b_ise_InstallationGuide13/b_ise_InstallationGuide12_chapter_011.html#ID-1417-000000d9
Thank you,
Jeff

Hello Prasad,
I am not sure what database are will be using in your system.
Check SAPnotes # 799639 "Hardware Requirements" and # 956921- IDES ERP 2005 ECC 6.0.
Here are databse approximations :
The database sizes are:
ORACLE: 200 GB
MaxDB: 180 GB
MSSQL: 150 GB
DB2-UDB 150 GB
DB2 on iSeries 240 GB
I can't comment on RAM size as i am not aware number of users, functionalities you will be using etc.
for this you can create a project under http://service.sap.com/sizing. You will get a close approximation.
This is a easy self guided procedure and its good, you can get a close hardware approximation thought this quick sizer tool.
Regarding processor its up to you. You can call vendors and check according to your budget.
Best Regards
NIraj

Increasing Disk Space on VMware ISE

hi,
i would like to increase the disk space for Vmware based cisco ise to 600gb.
Increasing the raw disk space is fine on VMware, but how will the ISE or Linux OS modify the partition to recognise the extra disk space
thank

Refreshing an old thread, but I was faced with this recently.
If you're prepared to roll up your sleeves with Linux, I've figured out a procedure. In my case I couldn't rehost the license since it's an NFR version - and yes Tarik is correct a restore doesn't bring in the license.
Some instructions here.
http://communities.labminutes.com/security/ise-expanding-the-data-partition/

Cisco Prime 2.1 - required disk space

Cisco Prime 2.1 requires 300GB disk space. My customer has asked is there any way of reducing this requirement as they haven't enough space in their VMWare servers. Could it be installed on a 100GB VM?

You can thin provision. Trying to change the overall profile though will most likely result in issues sooner or later. When you run out of disk space it will fail in ungraceful ways.

Cisco ISE 1.2 AD Integration Error

Hello,
I have a fresh install of Cisco 1.2.0.899 on a VM. I cant seem to join it to the Active Directory. It gives a message that says "Cannot Reach ISE Node" in the section where its supposed to show "Not Joined to the Domain". On further Examination i also noticed that i cannot download logs. it gives me an error that reads "Cannot Reach ISE Node".
Can someone please tell me what could be the possible cause of this error and how it can be resolved.
I have licences already installed added on the ISE Node. Re-imaging it will not be a good idea i guess.
Thanks
Ibrahim Kabir

I'd like to confirm if the required changes in the VM server were
made, as there are a few changes in the ISE OS. The changes required are
listed in the release notes, under "VMware Operating System to be
Changed to RHEL 5 (64-bit)". Here's a direct link to the relevant section:
http://www.cisco.com/en/US/docs/security/ise/1.2/release_notes/ise12_rn.html#wp384531
Other causes can be :-
certificate issue on ISE or not enough disk space.

Cisco ISE 1.2 AD Auth and Internal Auth on Same SSID?

Hello everyone... I'm fairly new to Cisco ISE 1.2 and am looking to try and setup a certain configuration. I'm trying to figure out how to create what amounts to a BYOD dmz'd wireless network that is PEAP based (or tls) but authenticates known users (employees from AD groups) but for users not found in those AD groups uses the internal user database and/or Web Auth? Make sense?
So, I of course can get the Authentication/Authorization policies configured for PEAPTLS and make to AD based on group and provide a VLAN number. No problem... I'm having trouble wrapping my head around how to combine the internal users or web auth users in this mix on the same ssid? I know by reading the ISE statement that the authentication policy if PEAP/TLS, ect is used, then a user not found is rejected and does not continue... Can someone provide an example as to how to accomplish this?
As a side note in 1.2, is there the ability to limit the number of consective logins as in ACS, outside of guess access only? What about in 1.3, which makes me nervous to upgrade in reading the instructions and the 'newness' of it.
Thank you for any help, it's greatly appreciated.

I'd like to confirm if the required changes in the VM server were
made, as there are a few changes in the ISE OS. The changes required are
listed in the release notes, under "VMware Operating System to be
Changed to RHEL 5 (64-bit)". Here's a direct link to the relevant section:
http://www.cisco.com/en/US/docs/security/ise/1.2/release_notes/ise12_rn.html#wp384531
Other causes can be :-
certificate issue on ISE or not enough disk space.

Cisco ISE Monitoring node backup size

Hello All,
We have a HA pair of ISE servers that have scheduled backups configured for the Admin persona (currently full weekly backup) and monitoring which is full weekly but with the addtional incremental daily backups. I've not seen any issue with the full weekly backup of the admin node however the monitor one provides unusual results in terms of file size between weekly and incremental backups.
Given the fact that we are currently piloting this with very little radius activity i'm curious as to how the daily backups can be bigger in filesize than the weekly?
The ISE is a ISE-3315-K9 running 1.1.3.124 and below are some examples
-rw-r--r-- 1 tsmbackup tsmbackup 502960384 Apr 21 07:08 mntincr_1_<removed>.tar.gpg (Incremental backup)
-rw-r--r-- 1 tsmbackup tsmbackup 459348307 Apr 21 01:04 mntdbfull_<removed>.tar.gpg (Full backup)
Thanks in advance for any suggestions.
M

Hi,
This could possibly due to ‘Data Purging’. When a purge operation triggers, if the actual used database disk space is greater than the configured threshold, the purge operation removes all data from the Monitoring database tables prior to the data retention window.
Following link might help in your case,
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_mnt.html#wp1074687

Cisco ISE installation on VMware Workstation ?

I am trying to install Cisco ISE image through Vmaware Workstation , but after starting VM getting redhat console but not the same console required for setup of actual ISE . Would like to know whether VMware workstation supported for ISE installation as all the cisco docs specifies the image to be mounted on ESX server, then login to client to run setup.. Please help...

Cisco "Officially" supports VMWare's ESXi/vSphere platform. Yes, ISE works in VMWare Workstation, but is not tested on every hardware platform available, therefore, not supported. The the case mentioned above,
I've started installing ISE 1.2 (redhat linux 5 64 bit) , looking at the posts above.. on VMware workstation 9..
1stly I gave 6gb ram ( my laptop has 6 gb ram & 290gb free space ) and started the installation process..
then after the starting stage of checking the requirements of my laptop started and the formatting of the disk began , my lap became very slow & it got hanged there..all my pc processes moved like snails..!! got frustated..
then I restarted my lap and this time I gave 4gb ram .. and it worked fine from then on..
can anyone tell me , if this has to do anthing with the physical memory we give over there in the ise installtion process..does it actually use the entire ram we mention over there..??
Niklas
All possible System RAM was allocated to the ISE VM, and the ISE VM used ALL of the RAM leaving none for the host OS, thereby slowing the machine to a crawl. Once this Virtual RAM was sized to the ISE minimum of 4GB (leaving 2GB dedicated to the host OS), the machine worked correctly. Yes, the ISE VM will happily use ALL the RAM allocated to it.
This is also the reason that Virtual Box and other "Desktop" class virtualization environments cannot be supported across the board. Nearly every machine hosting VMWare Workstation, Virtual Box, etc... has a different chipset, video card, HD controller, and on, and on...
The best thing to do for your situation is to try to install it. If it works, document your EXACT system configuration and the EXACT virtual configuration so that you may look back to it for future installs. You can also use this information to "tweak" the virtual settings until you get a combination that works for you. This will help to document the configurations that do not work on YOUR desktop environment.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Monitoring Cisco ISE - Smart Care

Dear,
I have a communication problem between ISE and Cisco Smart Care. I configure the community and the ip of the server but the SmartCare ISE displays the following message ¨ Device Type not Found¨.
I wonder if the Smart Care has the ability to withstand use for monitoring or if someone did this through SNMP configuration without problems.
Cisco ISE : 1.2
Smart Care : 1.14.15
Bestregards

Hi,
This could possibly due to ‘Data Purging’. When a purge operation triggers, if the actual used database disk space is greater than the configured threshold, the purge operation removes all data from the Monitoring database tables prior to the data retention window.
Following link might help in your case,
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_mnt.html#wp1074687

CSCul50066 - Upgrade fails due to lack of disk space in the /common partition

I noticed this has only 1 and 2 star ratings after bumping into this issue myself, so I figured I would help out the original poster and others who are experiencing this issue.
Presumably, the original poster is intending to advise that we read the CUCM 10.0(1) Upgrade Guide, and view the Pre-Upgrade Tasks therein. These (the bullet points below) seem to be the salient options contained in that section. I used the "Free Common Space COP file" option to resolve my disk space issue and allow my upgrade. I found the .cop file in the following download area on CCO:
Downloads Home
Products
Unified Communications
Call Control
Unified Communications Manager (CallManager)
Unified Communications Manager Version 10.0
Unified Communications Manager / CallManager / Cisco Unity Connection Utilities-COP-Files
It is called: "VMware Disk Size Reallocation COP file: This COP file allows UCM VMs to increase the size of their vDisk(s) without requiring a system rebuild.
ciscocm.free_common_space_v1.1.cop.sgn "
• Use the Cisco Log Partition Monitoring Tool to adjust the low and high watermarks to reduce the traces
and remove unnecessary log files. Cisco recommends that you adjust the low watermark value to 30,
and the high watermark value to 40. After the upgrade, you must restore the high and low watermarks
to their original values in order to avoid premature purging of traces. The default value for the high
watermark is 85. The default value for the low watermark is 80. For more information about using the
Cisco Log Partition Monitoring Tool, see the Cisco Unified Real-Time Monitoring Tool Administration
Guide.
• Use the Disk Expansion COP file (ciscocm.vmware-disk-size-reallocation-<latest_version>.cop.sgn) to
expand the vDisk size if your virtual environment has additional available disk space. Ensure that you
review the Readme file that supports this COP file before you proceed.
• Use the Free Common Space COP file (ciscocm.free_common_space_v<latest_version>.cop.sgn). This
COP file removes the inactive side in the common partition to increase available disk space without
requiring a system rebuild. Ensure that you review the Readme file that supports this COP file before
you proceed.
• Manually remove outdated or unused firmware files from the TFTP directory. You can remove these
files using the TFTP File Management page in the OS Administration interface, or you can use the file
list tftp and file delete tftp commands from the command line interface.

I noticed this has only 1 and 2 star ratings after bumping into this issue myself, so I figured I would help out the original poster and others who are experiencing this issue.
Presumably, the original poster is intending to advise that we read the CUCM 10.0(1) Upgrade Guide, and view the Pre-Upgrade Tasks therein. These (the bullet points below) seem to be the salient options contained in that section. I used the "Free Common Space COP file" option to resolve my disk space issue and allow my upgrade. I found the .cop file in the following download area on CCO:
Downloads Home
Products
Unified Communications
Call Control
Unified Communications Manager (CallManager)
Unified Communications Manager Version 10.0
Unified Communications Manager / CallManager / Cisco Unity Connection Utilities-COP-Files
It is called: "VMware Disk Size Reallocation COP file: This COP file allows UCM VMs to increase the size of their vDisk(s) without requiring a system rebuild.
ciscocm.free_common_space_v1.1.cop.sgn "
• Use the Cisco Log Partition Monitoring Tool to adjust the low and high watermarks to reduce the traces
and remove unnecessary log files. Cisco recommends that you adjust the low watermark value to 30,
and the high watermark value to 40. After the upgrade, you must restore the high and low watermarks
to their original values in order to avoid premature purging of traces. The default value for the high
watermark is 85. The default value for the low watermark is 80. For more information about using the
Cisco Log Partition Monitoring Tool, see the Cisco Unified Real-Time Monitoring Tool Administration
Guide.
• Use the Disk Expansion COP file (ciscocm.vmware-disk-size-reallocation-<latest_version>.cop.sgn) to
expand the vDisk size if your virtual environment has additional available disk space. Ensure that you
review the Readme file that supports this COP file before you proceed.
• Use the Free Common Space COP file (ciscocm.free_common_space_v<latest_version>.cop.sgn). This
COP file removes the inactive side in the common partition to increase available disk space without
requiring a system rebuild. Ensure that you review the Readme file that supports this COP file before
you proceed.
• Manually remove outdated or unused firmware files from the TFTP directory. You can remove these
files using the TFTP File Management page in the OS Administration interface, or you can use the file
list tftp and file delete tftp commands from the command line interface.

There is no more space for virtual disk ServerName_2.vmdk. You might be able to continue this session by freeing disk space on the relevant volume, and clicking Retry. Click Cancel to terminate this session.   Time: 30/05/2014 1:16:20 AM

Recently, our mail server crashed at about 7pm one night, with the error 'There is no more space for virtual disk ServerName_2.vmdk. You might be able to continue this session by freeing disk space on the relevant volume, and clicking Retry. Click Cancel to terminate this session.'
When we click Retry, the server starts up OK.
There are no snapshots listed in Snapshot manager for any of the virtual machines on the host.
There is also free disk space available on the host and for the VM with the disk errors.
This happened at least three more times, often at bad times. Each time, we were able to click 'Retry' and the disk/system would allow the VM to start-up successfully.
I checked the Forums, the VMware support articles and the internet as I had not seen this problem before. I have completed the VSphere 5.1 - Fast Track course and this issue was NOT covered in the training.
Most of the advice on-line and even that on the VMware web-site was pointing to snapshots being the cause of this issue. There are no snapshots enabled and I cannot see evidence of snapshots ever being used.
- We are running VMware vsphere (5.1.0) and there are (were) 4 virtual machines running on the ESX host. We are using the free version of VMware/ESXi.
- The Hard disk types we are using for this Virtual Machine are 'Thin Provisioned'.
- There are 4 [Thin Provisioned] Hard Disks for this virtual machine.
- There are 6 CPUs
- There is 20GB of RAM (memory)
- The VM is running Windows Server 2008 R2 as the guest/VM operating system. It is an Exchange 2010 SP1 mail server. There is plenty of available disk space on all the drives. The [Exchange] log files are cleaned out regularly (automated).
I decided to move one of our non-critical servers off this host and on to another host to see if this helped the problem. This took quite some time, as we are not using HA or vmotion, nor do we have VCenter Server...nonetheless, I finally managed to get the non-critical server on to another host (n.b. This was a much smaller machine with less virtual resources assigned to it).
After moving the non-critical server off this host, we decided to monitor the Host and see if the issue resolved itself.
I checked the host about 6-10 times a day, from first thing in the morning till last thing at night - monitoring the performance of not only the Virtual Machine, but the ESXi host also.
There were no adverse performance issues. The only thing I did note, was in the Summary page on the ESX Host, under Storage, was If I right-clicked on the datastore and clicked refresh, then the free disk space would drop (ie from 140GB to 125GB).
After monitoring the host and VM for about 2 weeks, we did NOT have another instance of the above error.
Sorry for the long winded post, but I wanted to give as much detail given this error has been raised before and snapshots are usually blamed as the cause.
My question is this:
If the ESX host had plenty of available disk capacity and there were no snapshots enabled on the VM (or any other VM's on the same host), then why did our Virtual machine crash with the error that 'there is not more space for virtual disk Servername_2.vmdk'?
How do we prevent this issue from happening if we don't know the underlying cause?
I would greatly appreciate any advice or suggestions.
If I have not provided enough info on the specs or environment, please let me know and I will provide more information.
Thanks all,
Kurt

The type of storage is really based on your requirements, and your ability to withstand downtime.
iSCSI as you are using with a NAS such as Synology or QNAP. NAS Selector - Support - Synology - Network Attached Storage (NAS)
I wouldn't use iSCSI for Exchange or any database. It's a bit slow.
Do you have a single physical host? Then I'd probably to an external direct attached storage. This would be a card inserted in your host server that gives you multilane SAS/SATA connectivity (www.techcable.com/SAS-SATA/SAS-SATA.pps) and an external disk enclosure/array.
For multiple hosts to a single array, I recommend a fibre channel connection to a FC capable switch, and on to a FC connected array.
We used to use a HP P2000 (on old G1), but it's since been retired. Worked pretty well once firmware was upgraded. http://www8.hp.com/us/en/products/disk-storage/product-detail.html?oid=4118559#!tab=features. They can be connected via iSCSI, Fibre Channel or 6GB SAS so they are flexible and reasonably priced.
Recommendations:
     Use RAID 6 with your large disk arrays. With large disks there is a measurable failure rate when rebuilding a failed RAID5 array based on MTBF.
     Use smaller 15K disks in RAID 0+1 for speed on databases/Exchange.
     Use slower 7.2K disks in RAID6 for file storage.
We are a small hospital and we have 3 VMware servers with dual CNA (FC and Ethernet in a single twinax cable) connections to 2 redundant Cisco Nexus 5K switches and then 4 Fibre Channel connections to an EMC VNX 5300. It's extremely fast with about 50 virtual servers, but was quite an investment. One thing we don't have to worry about is down time. If there ever is an equipment failure, we have redundant everything, including power split between two UPSs.
Our VNX has 3 tiers of performance. 3 100GB SSD "Fast Cache" in RAID 1 with hot spare, to keep the most used data ready, but it's not really a tier, however one could be built utilizing the same disks. A second tier is performance tier with a 8 600GB RAID 0+1 and hot spare. The third is a bunch of 7.2K 3TB disks in RAID6. The VNX autotiers, placing data on disks depending on where it's needed. The volumes are sliced and diced automatically in the background to make this happen and we never have to touch it. I used a demo of Solarwinds Storage Manager to monitor performance for a while and the utilization was always low, meaning all data access was fast, througout the day.
D

Disk space problem on MeetingPlace Express

I get the email below daily. I'm thinking it's ok to cat /dev/null the cma.log file?
I also think I might be able to do the same thing to stdout.old?
Anything else I should try other than the instructions?
* Directory listing
[mpxadmin@meeting ConfSchd]$ ls -la
total 3036516
drwxrwxr-x    2 mpxadmin mpx          4096 Aug 2 13:27 .
drwxrwxr-x   17 root     mpx          4096 Nov 4 2009 ..
-rw-rw-r--    1 mpxadmin mpx             0 Nov 4 2009 ActConf.lk
-rw-rw-r--    1 mpxadmin mpx             0 Nov 4 2009 Attach.lk
-rw-rw-r--    1 mpxadmin mpx             4 Dec 22 2012 confId
-rw-rw-rw-    1 mpxadmin mpx           391 Apr 5 2010 pegstats
-rw-rw-r--    1 mpxadmin mpx        255639 Aug 2 14:25 stderr
-rw-rw-r--    1 mpxadmin mpx       1152127 Dec 22 2012 stderr.old
-rw-rw-r--    1 mpxadmin mpx      516106727 Aug 2 16:50 stdout
-rw-rw-r--    1 mpxadmin mpx      2588797008 Dec 22 2012 stdout.old
-rw-rw-r--    1 mpxadmin mpx             0 Nov 4 2009 TCMap.lk
[mpxadmin@meeting ConfSchd]$
* EMAIL
This is an automated message from the MeetingPlace Express system with
hostname [meeting.afgrp.com] to inform you that disk space is low.
Details on where the problem is and how to resolve it are indicated below.
Low space in partition /. Percent used = [90].
The following files might cause trouble. However, inspect each one to make sure.
Look specifically for large files with old timestamps. Also, note that some of
the files indicated might have been previously mentioned. In this case, use the
prior instructions to handle these files rather than the instructions below.
If you are uncertain, contact Cisco TAC for confirmation/advice.
For the files below, use the following procedure to empty these files rather than
   delete them outright.
         1. For each file to be emptied do:
             cat /dev/null > <filename>
         2. After all files that you wish to empty have been emptied, do:
             su   // Enter 'root' password.
             mpx_sys restart
-rw-rw-r--   1 mpxadmin mpx     283120801 Apr 11 02:00 /var/mp/ConfSchd/stdout
-rw-r-----   1 root     root     127007041 Dec 22 05:30 /var/spool/compaq/cma.log
In general, to free up disk space where it is uncertain exactly what files are in question,
   do the following:
1. In general, go to places like /root, /mpxadmin, /tmp and do "ls -la" to look
     for large files. If a file is large, old, and seems like some kind of log or
     error file, it could be a candidate for deletion.
2. Generally files of type log (*.log), stderr, stdout, or txt (*.txt) are the
     best candidates to look for. A good command to look for these types of
     files with size of 10,000,000 bytes or larger is:
       find / -name "<file type>" -exec ls -la {} ; | awk '{if( >=10000000) {print} }'
     For example, to look for all log files 10,000,000 bytes or larger on
       the entire system:
         find / -name "*.log" -exec ls -la {} ; | awk '{if($5 >= 10000000) {print} }'
3. If you have a specific problem partition that you are trying to reduce size
     for, do the following:
     1. Find out the directory name of the top of the partition from "df".
     2. "cd" to that location.
     3. Then do: du -x -b --max-depth=1
     4. Look for the directories that are really large.
     5. Then "cd" into the worst subdirectory (or subdirectories).
     6. Get a list of all large files from current directory location and lower:
           (This example assumes 10,000,000 bytes and a check for .log files.
               Note the starting location of '.' (current location) rather
               than '/' (entire disk) ).
           find . -name "*.log" -exec ls -la {} ; | awk '{if($5 >= 10000000) {print} }'
Complete output of the 'df' command:
Filesystem           1K-blocks     Used Available Use% Mounted on
/dev/sda1             6048320   5111204   629876 90% /
/dev/sda6             4032092   767336   3059932 21% /common
/dev/sda2             8064304   6492268   1162380 85% /db
/dev/sda9               256667     8416   234999   4% /grub
/dev/sda7           122154520   110696 115838720   1% /mpx-record
/dev/sda5             5036284   3577128   1203324 75% /opt
/dev/sda3             6048352   109032   5632080   2% /partB
none                   1026932     22624   1004308   3% /dev/shm

Hi Josh,
It seems that the root partition of the MeetingPlace Express server is almost full. I have attached a document for your reference which can be used to minimize the disk space issues.
Once the steps mentioned in the attached document are completed, run the command "df" to check the disk space.
If you do not see much improvement in the root partition, then in that case some other files might need to be removed from the server to increase the root partition space.
If any of the partitions reach upto 90% or above, then the server might behave unexpectedly.
Feel free to revert if you have face any issues or have any queries.
Regards,
Rishabh

Help with cisco ISE 1.1.2.145 patch-3 to ISE 1.2.0.899-2-85601 upgrade procedure

Need help from ISE experts/gurus in this forum.
Due to a nasty bug in Cisco ISE (bug ID CSCue38827 ISE Adclient daemon not initializing on leave/join), this bug will make the ISE stopping working completely and a reboot is required (very nice bug from cisco) . This leaves me no choice but to upgrade to version 1.2.0.899-2-85601.
Scenario:
- 4 nodes in the environment running ISE version 1.1.2.145 patch 3
- node 1 is Primary Admin and Secondary Monitoring - hostname is node1
- node 2 is Secondary Admin and Primary Monitoring - hostname is node2
- node 3 is Policy service node - hostname is node3
- node 4 is Policy service node - hostname is node4
Objective: Upgrade the ISE environment to ISE version 1.2 with patch version 1.2.0.899-2-85601.
My understand is that I have to upgrade the existing environment from ISE version 1.1.2.145 patch 3
to ISE version 1.1.2.145 patch 10 (patch 10 was released on 10/04/2013) before I can proceed with
upgrading to ISE version 1.2 and patch it with 1.2.0.899-2-85601.
Can I patch my exsiting environment from 1.1.2 patch 3 to patch 10 prior to upgrading to version 1.2.0.899-2-85601?
I look at Cisco website and patch 10 was released on 10/04/2013 while version 1.2 was released back in 07/05/2013.
I am trying to get a definite answer from Cisco TAC but it seems like they don't know either.
Question #1: How do I proceed with upgrading the current ISE environment from 1.1.2.145 patch 3 to 1.1.2.145 patch 10?
Propose solution:
step #1: make ISE node1 to be both Primary Admin and Primary monitoring. ISE node2 is now Secondary Admin and Secondary Monitoring.
         Then go ahead and apply ISE version 1.1.2.145 patch 10 to ISE node2 via the GUI,
step #2: Once ISE node2 patch 10 is completed, make node2 Primary Admin and Primary Monitoring. At this point, apply ISE 1.1.2.145 patch 10
         to ISE node1 via the GUI,
step #3: Once ISE node1 patch 10 is completed, make node1 Primary Admin and Secondary Monitoring and node2 Secondary Admin and Primary Monitoring,
step #4: apply ISE 1.1.2.145 patch 10 to ISE Policy Service node3. Once that is completed, verify that node2 is working and accepting traffics,
step #5: apply ISE 1.1.2.145 patch 10 to ISE Policy Service node4. Once that is completed, verify that node2 is working and accepting traffics,
Question #2: How do I proceed with upgrading the current ISE environment from 1.1.2.145 patch 10 to ISE version 1.2 with patch version 1.2.0.899-2-85601?
Propose solution:
step #1: Make ISE node1 the Primary Admin and Primary monitoring. At this point ISE node2 will become Secondary Admin and Secondary Monitoring
step #2: Perform upgrade on the ISE node2 via the command line "application upgrade <app-bundle> <repository>". Once ISE node2 upgrade is completed, it will
          form a new ISE 1.2 cluster independent of the old cluster,
step #3: Perform upgrade on the ISE Policy Service node3 via the command line "application upgrade <app-bundle> <repository>". After the upgrade the ISE
          Policy Service Node3 will automatically joins the ISE node2 which is already in version 1.2
step #4: Perform upgrade on the ISE Policy Service node4 via the command line "application upgrade <app-bundle> <repository>". After the upgrade the ISE
          Policy Service Node4 will automatically joins the ISE node2 which is already in version 1.2
step #5: At this point the only node remaining in the 1.1.2.145 patch 10 is the ISE node1 Primary Admin and Primary Monitoring
step #6: Check and see if there are any more PSN's registered in ISE node1 (there should not be any)
step #7: Perform the upgrade on the ISE node1 from command line "application upgrade <app-bundle> <repository>"
step #8: Once upgrade on ISE node1 is complete, ISE node1 will automatically join the new ISE 1.2 cluster,
step #9: Make ISE node1 Primary Admin and Secondary and ISE node2 Secondary Admin and Primary Monitoring,
Question #3: How do I proceed with upgrading the current ISE environment from 1.2 patch0 to 1.2.0.899-2-85601?
Propose solution:
step #1: make ISE node1 to be both Primary Admin and Primary monitoring. ISE node2 is now Secondary Admin and Secondary Monitoring.
         Then go ahead and apply ISE 1.2.0.899-2-85601 to ISE node2 via the GUI,
step #2: Once ISE node2 1.2.0.899-2-85601 is completed, make node2 Primary Admin and Primary Monitoring. At this point, apply 1.2.0.899-2-85601
         to ISE node1 via the GUI,
step #3: Once ISE node1 patch 10 is completed, make node1 Primary Admin and Secondary Monitoring and node2 Secondary Admin and Primary Monitoring,
step #4: apply ISE 1.2.0.899-2-85601 to ISE Policy Service node3. Once that is completed, verify that node2 is working and accepting traffics,
step #5: apply ISE 1.2.0.899-2-85601 to ISE Policy Service node4. Once that is completed, verify that node2 is working and accepting traffics,
does these steps make sense to you?
Thanks in advance.

David,
A few answers to your questions -
Question 1: My recommendation is to follow vivek's blog since most fixes and upgrade steps are provided there - I would recommend installing the patch that was release prior to the 1.2 release date since the directions to "install the latest patch" would put you at the version of when the ISE 1.2 was released
https://supportforums.cisco.com/community/netpro/security/aaa/blog/2013/07/19/upgrading-to-identity-services-engine-ise-12
You do not have the ability to install ISE patch through the GUI on any of the "non-primary" nodes (you can use the cli commmand to achieve this), the current patching process was designed so you can install the patch on the primary admin node and it will then roll the patches out to the entire deployment (one node at at time). I painfully verified this by watching the services on each node and when a node was up and operational the next node would start the patching process. First the admin nodes then the PSNs.
Every ISE upgrade that I have attempted as not been flawless and I can assure you that I have done an upgrade on 1.1.2 patch 3 and this worked fine, however I used the following process. You will need the service account information that is used to join your ISE to AD.
I picked the secondary admin/monitoring node and made it a standalone node by deregistering (much like the old procedure) in your case this will be node2.
I backed up the certificates from the UI and the database from the CLI (pick the local disk or ftp-your choice).
I reset the database and ran the upgrade script (since I did not have access to the vsphere console or at the location of the non UCS hardware [for a 1.1.4 upgrade]).
Once the upgrade was completed I then restored the 1.1.x database, ISE 1.2 now has the ability to detect the version of the database that is restored and will perform the migration for you.
Once the restore finished, I then restored the certificate and picked one of the PSNs
backup the cert,
Had the AD join user account handy
reset-db,
and run the upgrade script.
Once that is done I then restore the cert
Join the PSN to the new deployment
Join both nodes to AD through primary admin node
Monitor for a few days (seperate consoles to make sure everything runs smooth)
If anything doesnt look or feel right, you can shut down the 1.2 PSN and force everything through the existing 1.1.2 setup and perform some investigation, if it all goes smooth you can then follow the above step for the other two nodes, starting with the last PSN and the the last admin node.
Thanks and I hope that helps,
Tarik Admani
*Please rate helpful posts*

CSA MC insufficient disk space

Hello!
There is a little problem - low disk space on CSA MC machine. Shrinking database doesn't help. And backups store on anouther logical disk so they don't take free space.
As I understand the way is to "move" all CSA MC database to anouther machine by reinstalling CSA MC with "Remote Database" option. Am I right? So is there different ways to move CSA MC database files without reinstalling product?
Thank you,
Ann

To free Up Disk Space on CSA MC (Insufficient Disk Space Event)
Use the following procedure to shrink your database files and log files and increase the amount of free disk space on your CSA MC system. If your CSA MC event log contains an "insufficient disk space" message, this is an appropriate procedure for freeing up space.
Delete old log files and old CSA MC database files
Step 1 Stop the CSA MC and agent services.
From a command prompt window, type the following commands:
net stop Cisco Security Agent
net stop Cisco Security Agent MC
Step 2 Access the CSCOpx\CSAMC\db and CSCOpx\CSAMC\cfg folders and delete old database files with names such as: csamc.mdf.Vm.n.0.ddd, csamc_log.ldf.Vm.n.0.ddd, csamc_volatile_data.ndf.Vm.n.0.ddd.
Caution DO NOT delete files csamc.mdf, csamc_log.ldf and
csamc_volatile_data.ndf. (Files with no old version number suffixes.)
Step 3 Access the CSCOpx\CSAMC\log directory and delete old log files of the form csamc.nnn.
Step 4 Start the CSA services. From a command prompt window, type the following commands:
net start Cisco Security Agent
net start Cisco Security Agent MC

Cisco ISE 1.2 disk space

Similar Messages

Maybe you are looking for