Troubleshooting Tip: Getting 'Disk log has rolled' message in logs

The GUI shows the following log entry:

devid="FG100D3XXXXXX" logid="0100032011" type="event" subtype="system" level="notice" vd="root" eventtime=1641945601 logdesc="Disk log rolled" action="roll-log" reason="file-size" log="elog" msg="Disk log has rolled."

Run the following command to confirm the log settings:

config log disk setting
dia sys logdisk usage

FGT # config log disk setting
set status enable
set maximum-log-age 7      <- Max log age is set to 7 Days
set upload disable
set max-log-file-size 20    <- Max log file is set to 20MB
set roll-schedule daily     <- Disk roll is set to daily
set roll-time 00:00
set diskfull overwrite     
end

FGT # dia sys logdisk usage
Total HD usage: 113430MB(108176MiB)/471491MB(449649MiB)
Total HD logging space: 353617MB(337236MiB)
HD logging space usage for vdom "root": 112856MB(107628MiB)/353617MB(337236MiB)

FortiGate systems reserve about 25% of disk space for system utilities and possible quota overflows, ensuring that roughly 75% of the disk space is available for log storage.

When the generated logs exceed 20 MB, FortiGate will move the file to the achieve on the disk and create a new log file. This is the expected behavior.

Related article:
Technical Tip: Configuring Firewall for Log Roll Over when Disk Usage Exceeds 80%