Field Notice: FN72230 - Virtual Email Security Appliance/Security Management Appliance Upgrade Fails Due to Small Nextroot Partition Size - Workaround Provided

An attempt to upgrade a Virtual Email Security Appliance (vESA) or Virtual Security Management Appliance (vSMA) with a nextroot partition size less than 500MB fails.

Initially, vESA and vSMA images were built with a nextroot partition size of less than 500MB. Over the years, and with later AsyncOS releases that include additional features, upgrades have had to use more and more of this partition throughout the upgrade process. This results in upgrades that fail because of this partition size.

This issue is known to affect upgrades to AsyncOS Version 14.x, 15.5, and later for both ESA and SMA appliances.

An older vESA or vSMA image with a nextroot partition size of less than 500MB might fail to upgrade with these errors:

...
...
...
Finding partitions... done.                                                    
Setting next boot partition to current partition as a precaution... done.      
Erasing new boot partition... done.                                            
Extracting eapp done.                                                          
Extracting scanerroot done.                                                    
Extracting splunkroot done.                                                    
Extracting savroot done.                                                       
Extracting ipasroot done.                                                      
Extracting ecroot done.                                                        
Removing unwanted files in nextroot done.                                      
Extracting distroot                                                            
/nextroot: write failed, filesystem is full
./usr/share/misc/termcap: Write failed
./usr/share/misc/pci_vendors: Write to restore size failed
./usr/libexec/getty: Write to restore size failed
./usr/libexec/ld-elf.so.1: Write to restore size failed
./usr/lib/libBlocksRuntime.so: Write to restore size failed
./usr/lib/libBlocksRuntime.so.0: Write to restore size failed
./usr/lib/libalias.so: Write to restore size failed
./usr/lib/libarchive.so: Write to restore size failed

For Cisco AsyncOS releases 15.5 and later, if the next partition is less than 4GB, the upgrade will be aborted, and the following message will be printed in the console:

Your system upgrade to AsyncOS 15.5 version is blocked because the machine has a next root partition of less than 4GB disk space. You must deploy a new virtual appliance with a next root partition of 4 GB disk space. For more information on how to deploy a new virtual appliance with a next root partition of 4 GB disk space, see the Field Notice (FN) at https://www.cisco.com/c/en/us/support/docs/field-notices/722/fn72230.html.

To ensure that the vESA/vSMAcan be upgraded, first check if the nextroot partition size is 4GB using the ipcheck CLI command, as shown in the following example:

(lab.cisco.com) > ipcheck
<----- Snippet of relevant section from the output ----->

  Root                  4GB 7%
  Nextroot              4GB 1%
  Var                   400MB 3%
  Log                   172GB 3%  
  DB                    2GB 0%  
  Swap                  6GB  
  Mail Queue            10GB

<----- End of snippet ----->

Important: If the nextroot partition is less than 4GB, it is highly recommended that you prevent nextroot partition size issues on future upgrades by following the steps in How to Apply the Workaround for Cisco vESA/vSMA Failing Upgrade Due to Small Partition Size to migrate your current VM template to a later updated image.