v19 VMware disk usage, reporting full

Feel free to do this via your Support Channel. 

are you serious?
Sophos knows about the BUG, but still provides the buggy installer?

What is this?

Just to document the problem further:

Initial problem:
Installation image HW-19.0.0_GA-317 is buggy. Appliances that are set up with this image have the report partition filled to 100% after a few weeks.

1st statement Sophos:
Problem is known. There are two fixes: NC-94291 & NC-100679
Try an update to 19.0.1 MR-1
DOES NOT WORK!

2. statement Sophos:
Do a fresh install with 19.0.1 MR-1 and then restore the backup.
DOES NOT WORK, because an installation image 19.0.1 MR-1 does not exist.

3. statement Sophos:
Do a fresh install with 18.5.4 and then restore the backup.
DOES NOT WORK,
After reinstallation "check for new firmware" -> no updates available.
Watch out, because you can not restore the backup from 19.x to 18.5.4!
You have to download and install the update manually, but Update from 18.5.4 to 19.0.0 GA-317 is not supported!!!!
Verify update matrix https://docs.sophos.com/releasenotes/index.html?productGroupID=nsg&productID=xg&versionID=19.0

The Sophos support did not offer a solution until today!

So at the moment we only have to keep an eye on the already installed machines and if necessary keep them alive with "Flush Device Reports".

What's going on at Sophos again?

BR Gerd

Let me rephrase this: 

There are different points. And you are starting to mix up certain points: 

First of all, there are Bugs, which let the /var/ partition fill up. Those root causes are fixed in V19.0 MR1. So the /var/ is not increasing "unexpectedly". Due the fact, that /var/ is used for other things like reporting, it is natural to increase over time, but will be flushed after a while by the settings of the system (Report settings).
This is fixed by  NC-94291 & NC-100679 - So no unexpected increase of /var/. 

The current ISO of V19.0 MR1 is not available due the fact, V19.0 MR1 got a respin. Therefore we do not want to push Build350 to the public anymore. The team is currently working on getting ISOs pushed out. The problem is: You have regulations, which has to be hit (Software Export compliance etc.). 

You can install V18.5 MR4 and upgrade to V19.0 MR1 with the SIG File, you find on your portal. V19.0 MR1 is not available for machines via up2date. And i posted no advise to "restore" the backup. I talked about do a V18.5 MR4 installation, upgrade it and then restore. Maybe this was not clear from my end. 

After a week off from the Internet, I'm trying to solve this problem again.

I ran offered update SFOS 19.0.1 MR1-Build365 on our other SFV4C6 VM. Use of /var is still 60% there (just like before update, this firewall is not so loaded).

But I'm not able to upload VI-19.0.1_MR-1.VMW-365.sig to the main firewall (neither VI-19.0.1_MR-1.VMW-350.sig used on the other firewall). I tried it several times, I can select the file, agree "Are you sure you want to upload the firmware?" question, the wheel spins for a while and then it returns to the "Firmware upgrade/downgrade" window. Maybe the file can§t be uploaded due to low space on /var?

"Check for new firmware" shows "No updates available". Is any other way how to install this update?

LuCar Toni said:

This could be:  NC-94291

Fixed in MR1. 

What exactly is being addressed in NC-94291? I can see

NC-94291 Firmware Management Small var partition created for VM image using an auxiliary disk.

The problem is "Small var partition created for VM image using an auxiliary disk.". How is this solved?

LuCar Toni said:

We are not increasing the the /var/ because there is no reason to do. But 41% is actually fine from my perspective. /var/ is rarely used. 

95% and more isn't fine from our perspective. MTA rejects emails, problems with SSLVPN access and with the update itself as I wrote before.

SFV4C6_VM01_SFOS 19.0.0 GA-Build317# df -h
Filesystem Size Used Available Use% Mounted on
none 640.6M 11.6M 582.3M 2% /
none 2.9G 28.0K 2.9G 0% /dev
none 2.9G 9.0M 2.9G 0% /tmp
none 2.9G 14.6M 2.9G 0% /dev/shm
/dev/boot 127.7M 26.6M 98.4M 21% /boot
/dev/mapper/mountconf
560.3M 97.2M 459.1M 17% /conf
/dev/content 11.8G 493.9M 11.3G 4% /content
/dev/var 3.7G 3.5G 197.3M 95% /var

Hi Thomas

The update does not seem to do anything (see below, checked on a brand-new appliance)

I'm still waiting for a solution from Sophos support, but it's very tough here as usual :-(
Although the error should actually be known.......

Before Update

console> system diagnostics show disk

Partition        Utilization(%)

===============================

configuration         9%

content               3%

report               34%

SFVUNL_HV01_SFOS 19.0.0 GA-Build317# df -h

Filesystem                Size      Used Available Use% Mounted on

none                    640.9M     11.6M    582.7M   2% /

none                      1.9G     24.0K      1.9G   0% /dev

none                      1.9G     12.9M      1.9G   1% /tmp

none                      1.9G     14.6M      1.9G   1% /dev/shm

/dev/boot               127.7M     26.9M     98.1M  21% /boot

/dev/mapper/mountconf

                        560.3M     51.9M    504.4M   9% /conf

/dev/content             11.8G    393.0M     11.4G   3% /content

/dev/var                  3.7G      1.2G      2.4G  34% /var

After Update

console> system diagnostics show disk

Partition        Utilization(%)

===============================

configuration        13%

content               3%

report               35%

console>

SFVUNL_HV01_SFOS 19.0.1 MR-1-Build365# df -h

Filesystem                Size      Used Available Use% Mounted on

none                    613.2M      1.5M    567.0M   0% /

none                      1.9G     32.0K      1.9G   0% /dev

none                      1.9G     12.6M      1.9G   1% /tmp

none                      1.9G     14.6M      1.9G   1% /dev/shm

/dev/boot               127.7M     34.3M     90.7M  27% /boot

/dev/mapper/mountconf

                        560.3M     71.6M    484.7M  13% /conf

/dev/content             11.8G    386.1M     11.4G   3% /content

/dev/var                  3.7G      1.3G      2.4G  35% /var

LuCar Toni said:

We are not increasing the the /var/ because there is no reason to do. But 41% is actually fine from my perspective. /var/ is rarely used. 

It´s not fine! As I wrote several times!

We have appliances that are 100% filled after a few weeks.

The only thing that helped here was to flush device reports and set the report storage duration to the shortest time interval!

But obviously, once again, no one at Sophos wants to know anything about it.

WE NEED A SUPPORT SOLUTION WITHOUT REINSTALLATION!

I do not wont to be rude, but my answer is pretty clear: