Symptom

The FMC runs out of disk space and becomes non-functional. The /var/log/messages file may have warnings like "Dropping events for oversize partition" and "Dropped 52000000 events for oversize partition packet_log_1669396080". If these messages are not seen, then look for a large volume of intrusionpacket_* files in /Volume/lib/monetdb/to_import.

Conditions

A device is running a Snort version impacted by CSCwd82801

Workaround

Upgrade the devices to a version with the CSCwd82801 fix.

Further Problem Description