Technical Tip: FortiAnalyzer logfile size and rolling
Description
This article describes how to reduce the size of uploaded files.
Sometimes, the size of log files uploaded by FortiAnalyzer is much larger than the rollover file size defined in log settings.
An uploaded log file of size 1500KB or above may be seen with these settings:
config system log settings
config rolling-regular
set file-size 500
set upload enable
set when daily
set directory "/"
set ip 192.192.192.1
set log-format csv
set username "XXX"
end
end
Scope
FortiAnalyzer
Solution
The rolling log file size is in native log format, and the size of log files can be viewed in the GUI under Log View -> Log Browse.
For uploaded log files, the size varies depending on the selected format. For example:
- CSV uncompressed is the format that generates the larger files.
- Native format generates smaller files.
To reduce the size of uploaded files, the gzip compressed format can be selected:
config system log settings
config rolling-regular
set upload enable
set gzip-format enable
end
config rolling-regular
set upload enable
set gzip-format enable
end
The example below shows the storage space required for a log file of size 571KB on FortiAnalyzer:
