Technical Tip: How to Increase Elastic Search Size on FortiEDR Manager to utilize the disk space resized on TH VM.

Assuming that data disk on TH VM is not fully utilized or after expanding the data disk on TH VM the elastic search size needs to be reconfigured to use the full disk data, as documented in this article.

1. SSH to FortiEDR Manager as the 'root' user.
2. Run the command 'fortiedr stop'.
3. Use any text editor to edit the /opt/FortiEDR/webapp/application-customer.properties file. For example:

vi /opt/FortiEDR/webapp/application-customer.properties

4. Search for edr2.storageAllocatedInGb and edit the value.
5. As best practice, use 80-90% of the total disk on TH as elastic Search. Command and screenshot for reference:

cat /opt/FortiEDR/webapp/application-customer.properties | grep edr2.storageAllocatedInGb

6. Run the following command:
   
   

fortiedr start

Note: Fortinet highly recommends taking a snapshot of FortiEDR Manager before making any changes.

If there are still any problems encountered, open a new technical support ticket for further assistance: Support Fortinet.