Technical Tip: Add a bigger log disk to FortiGate VM in Azure

This article describes how to increase the disk log size of a FortiGate-VM. The procedure will delete all existing logs from the FortiGate. Tested with version: v7.0.9 and v7.2.3

This procedure will delete all existing logs from the FortiGate:

1. (Optional) Export any logs to archive.
2. Shut down the VM.
3. Azure:

• Delete existing Data disk.
• Add a new bigger data disk.
• (optional) disable Host Caching.
• Save.

5. Power on the VM.
6. (Optional) Check 'Serial console' for the VM in Azure.
7. Wait a few minutes as the new disk will be automatically formatted and will be ready to use.

Before.

Shut down FortiGate-VM:

execute shutdown

Delete existing data disk:

Create a new disk. 'Create and attach new disk'. Provide the Size disable 'Host caching' and save.

Power on:

Power on the machine and look at the console. It will take a few min to format the new disk. After that, it will reboot and FortiGate will start using this disk for log.

Result.

Optionally, reconfigure log settings to keep additional log days.

• Check Disk logging' on the Administration Guide

Note: 

FortiGate systems allocate 25% of the disk space for system utilities and unexpected quota overflows, leaving around 75% of the disk space usable for log storage.

Additional related articles:

How to download Logs from FortiGate GUI

Backup logs in plaintext format avoid performing LZ4 decompression

Technical Tip: Configuring Firewall for Log Roll Over when Disk Usage Exceeds 80%