Field Notice: FN - 72230 - Virtual Email Security Appliance/Security Management Appliance Upgrade Fails Due to Small Nextroot Partition Size - Workaround Provided

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.1	05-Apr-23	Updated the Background and Problem Symptom Sections
1.0	14-Sep-21	Initial Release

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	AsyncOS for Content Security Management Appliance (SMA)	14	14.0.0
NON-IOS	AsyncOS for Secure Email	14	14.0.0

Defect Information

Defect ID	Headline
CSCvy69068	Upgrade of virtual ESA fails due to small partition size
CSCvy69076	Upgrade of virtual SMA fails due to small partition size

Problem Description

An attempt to upgrade a Virtual Email Security Apppliance (vESA) or Virtual Security Management Appliance (vSMA) with a nextroot partition size less than 500MB fails.

Background

Initially, vESA and vSMA images were built with a nextroot partition size of less than 500MB. Over the years, and with later AsyncOS releases that include additional features, upgrades have had to use more and more of this partition throughout the upgrade process. This results in upgrades that fail because of this partition size.

This issue is known to affect upgrades to AsyncOS Version 14.x, 15.x, and later for both ESA and SMA appliances.

Problem Symptom

An older vESA or vSMA image with a nextroot partition size of less than 500MB might fail to upgrade with these errors:

...
...
...
Finding partitions... done.                                                    
Setting next boot partition to current partition as a precaution... done.      
Erasing new boot partition... done.                                            
Extracting eapp done.                                                          
Extracting scanerroot done.                                                    
Extracting splunkroot done.                                                    
Extracting savroot done.                                                       
Extracting ipasroot done.                                                      
Extracting ecroot done.                                                        
Removing unwanted files in nextroot done.                                      
Extracting distroot                                                            
/nextroot: write failed, filesystem is full
./usr/share/misc/termcap: Write failed
./usr/share/misc/pci_vendors: Write to restore size failed
./usr/libexec/getty: Write to restore size failed
./usr/libexec/ld-elf.so.1: Write to restore size failed
./usr/lib/libBlocksRuntime.so: Write to restore size failed
./usr/lib/libBlocksRuntime.so.0: Write to restore size failed
./usr/lib/libalias.so: Write to restore size failed
./usr/lib/libarchive.so: Write to restore size failed

For AsyncOS Version 15.x and later, if the next partition is less than 4GB, the upgrade will be aborted, and this message will be printed in the console.

Your system upgrade to AsyncOS 15.0 version is blocked because the machine has a next root partition of less than 4GB disk space. You must deploy a new virtual appliance with a next root partition of 4 GB disk space. For more information on how to deploy a new virtual appliance with a next root partition of 4 GB disk space, see the Field Notice (FN) at https://www.cisco.com/c/en/us/support/docs/field-notices/722/fn72230.html.

Workaround/Solution

In order to ensure your vESA/vSMA can be upgraded, you need to first check if the nextroot partition size is 4GB with the ipcheck CLI command.

(lab.cisco.com) > ipcheck

<----- Snippet of relevant section from the output ----->

  Root                  4GB 7%
  Nextroot              4GB 1%
  Var                   400MB 3%
  Log                   172GB 3%
  DB                    2GB 0%
  Swap                  6GB
  Mail Queue            10GB

<----- End of snippet ----->

If the nextroot partition is less than 4GB, see How to Apply the Workaround for Cisco vESA/vSMA Failing Upgrade Due to Small Partition Size in order to migrate your current VM template to a later updated image.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.