Technical Tip: How to troubleshoot the 'daily logs GB/day limit is exceeded' warning on FortiAnalyzer

1. When seeing this warning notification 'Your daily logs GB/day limit is exceeded within the last 7 days.' on the FortiAnalyzer’s alert pane, it means that the logging rate of this FortiAnalyzer has exceeded the licensed logging rate.

2. This can be verified under System Settings -> Dashboard -> 'License Information' widget -> Logging -> GB/Day -> Details. In the image shown below, the daily licensed logging rate is 201 GB/day but the actual logging rate detected by FortiAnalyzer has exceeded that amount for the past 7 days.

    

   

    

    

3. This could be a good time to think of purchasing a bigger license to accommodate the increased logging rate.  Operating your VM beyond the licensed capacity could affect the ability to receive technical support.

   
   Any additional licenses that are purchased are stackable with the old license. For example, if originally it was on the FAZ-VM-GB1 (1 GB/day) license and had purchased a FAZ-VM-GB5 (5 GB/day) license, the entitled GB/day logs would be 6 GB/day.

    

   

    

   Datasheet: FortiAnalyzer Data Sheet.

    

4. Alternatively, it is possible to consider minimizing logging from the FortiGate to the FortiAnalyzer-VM via the KB article below or use the below command:

   
   diagnose fortilogd lograte-device
   
   Logs per second
   Totals Last Hour Day Week
   -------------------------------------------------------
   FGXXXXXXXXXX: 0.00 0.00 0.00
   FGXXXXXXXXX2: 0.00 0.00 0.00

    

   That will show the FortiGate sending the most on the past hour Day and week.

    

5. Administrators have the ability to control the volume of logs received by defining rate limits either at the ADOM level or for individual logging devices. Unless explicitly configured, the system does not impose any restrictions on log intake. This functionality is available exclusively through the CLI and allows configuration of both a general log rate limit that applies system-wide and customized limits for specific devices or ADOMs. In cases where both a general limit and a device-specific limit are present, the device-specific configuration overrides the general setting for those particular devices: Configuring log rate receiving limits.
6. SQL table compression is also possible to reduce disk utilization using CLI:

config system sql

    set compress-table-min-age <days>

end

Related articles:

• Technical Tip: Minimizing logging from FortiGate to FortiAnalyzer.
• Technical Tip: Adding/extending additional disk under a KVM/QEMU environment to FortiManager and FortiAnalyzer
• Technical Tip: Extending disk space in FortiAnalyzer VM / FortiManager VM