Symptom

High unmanaged disk usage on /ngfw alerts are seen on FMC GUI due to an accessive URL file storage in the FTD sensor. The files size is 500M: root@Firepower:/ngfw/var/sf/cloud_download# ls -larsht 500M -rw-r--r-- 1 root root 500M Apr 7 14:55 cisco_uridb_large_1586269510 500M -rw-r--r-- 1 root root 500M Apr 8 15:10 cisco_uridb_large_1586358146 500M -rw-r--r-- 1 root root 500M Apr 9 15:01 cisco_uridb_large_1586443991

Conditions

Firepower Threat Defense devices This issue was present on devices running URL licenses or not

Workaround

Remove the files manually under this location on the affected sensor as the system is not purging the 500Mb files: root@Firepower:/ngfw/var/sf/cloud_download# rm -r cisco_uridb_large*

Further Problem Description