Technical Tip: Clear old system logs in FortiSIEM

Description

This article describes how to clear old logs.

Scope

FortiSIEM.

Solution

The following steps describe how to review the current space used by the logs and provide a way to clear old logs.

Note: Proceed with the steps below only after gathering the logs if there is a TAC case and not enough space.

To review the current available space:

df -hT | grep -e nfs -e xfs

To review the size of the log directories:

du -sh /opt/phoenix/log/
du -sh /var/log/ndu -sh /opt/glassfish/domain*/domain*/logs/

To find the logs that were created a week ago:

find /opt/phoenix/log/phoenix* -ctime +14 -iname "*log*"    # find logs that are 14+ days older
find /var/log/ -ctime +14 -iname "*log*"
find  /opt/glassfish/domain*/domain*/logs/  -ctime +14 -iname "*log*"

After reviewing the logs, add -delete at the end of the commands above to delete the logs.

Related article:

Troubleshooting Tip: How to clear application server cache