Sophos Firewall – Determine disk space and manage reports
This article explains how to check the disk space on a Sophos Firewall and take action to free up space if necessary. This article is aimed at customers who may have received a warning email that the disk space on their firewall is more than 80% full. Although this problem is relatively rare, it can occur under certain circumstances – for example, if there is a lot of logging, high network traffic or the hard disk size of virtual appliances is too small.
When storage capacity on the Sophos Firewall is running low, it is important to react quickly to ensure smooth operation. This article shows how to check the current storage status and, if necessary, adjust or deactivate the storage of Onbox reports, especially if these reports are already archived in Sophos Central.
Show disk space on Sophos Firewall Console
The storage space on a Sophos Firewall can be queried via the device’s console.
Show memory space: To see the memory used on the firewall, use the following command:
system diagnostics show disk
Show disk space on Sophos Firewall Advanced Shell
The storage space on a Sophos Firewall can be queried via the Advanced Shell of the device.
Display storage space: To view the memory capacity on the firewall, use the following command:
df -hkm
This command shows an overview of the file systems, the size, the occupied and available capacity as well as the percentage memory consumption.
Delete Sophos Firewall reports
If the storage volume increases rapidly, it may be necessary to adjust the storage duration of the reports. This can be done under the following menu items, as shown in the screenshot.
If you ignore the memory warning and the services are terminated because the firewall is no longer working properly, you must delete the reports manually. This can be done as shown in the screenshot in the GUI or via SSH: 5. device management > 4. flush device reports.
Disable Sophos Firewall offline reports
Reports on Sophos Firewall can take up a lot of disk space, especially if the report database service is heavily loaded. If the hard disk space is running low or the reports are no longer displayed, it may be necessary to deactivate the report function or delete reports.
⚠️ Deactivating the onbox reports or manually deleting report data can lead to the loss of locally stored logs and reports. Ensure in advance that all required data is backed up before carrying out these actions. Once deleted, reports cannot be restored.
Display reports: To check whether the report function is active, use the command:
show on-box-reportsDeactivate reports: If the report function is not required, you can deactivate the function with the following command:
set on-box-reports offHowever, reports are certainly important and we would only deactivate this function if the logs are stored on Sophos Central. You can also buy more memory with the license: Sophos Central Firewall Reporting Advanced
Conclusion
Managing disk space on the Sophos Firewall is critical to ensure optimal performance. By regularly checking memory usage and disabling unnecessary reports, you can ensure that the firewall continues to work reliably and efficiently. If there are problems with the reporting function, such as no reports being displayed, deleting old data or disabling the function can provide a quick solution.
Further links:
These tips help to extend the service life of the firewall and to manage the storage space efficiently.