Technical Tip: How to expand local disk for eventdb mounted on /data

Follow the steps on FortiSIEM VM only once the disk size has been extended from Hypervisor console.

1. Login to FortiSIEM VM as 'root' user.

2. Run the 'lsblk -f' command to get the disk name (/dev/sdX) and filesystem type for /data mountpoint.

Example:

# lsblk -f
NAME FSTYPE LABEL UUID MOUNTPOINT
sda
├─sda1 ext4 14698528-2a23-45df-aacb-5e302405cb80 /boot
└─sda2 LVM2_member Fs33O8-mvHw-qylg-MJHz-q4vF-6WSW-j2SPN3
├─cl-swap swap 0cc76609-2a1e-48b0-8b1f-dbecdfb31b56 [SWAP]
└─cl-root xfs 9f41a631-1dfb-4b16-aa57-3a9488478021 /
sdb
├─sdb1 swap cf59519c-26ed-49c1-aedd-cc055f00e220 [SWAP]
└─sdb2 xfs 83280e68-6680-402e-b14e-7f986979033e /opt
sdc
└─sdc1 xfs 9969265e-def4-4e66-ae4c-46faf9d438f9 /cmdb
sdd
└─sdd1 xfs 84544514-bed9-43ef-b229-65f4273134d2 /svn
sde xfs 53921b9b-0f72-4b07-9b9a-8d72a15790c4 /data

3. Run xfs_growfs command to expand file system to total space available on the disk.

xfs_growfs <disk name>

Example:

xfs_growfs /dev/sde

4. Finally, verify the disk size:

df -h /data

Note:
Increasing the /data partition size is a valid procedure, but rapid disk filling is not standard behavior, specially for physical appliances. If the partition continues growing unexpectedly, create a support ticket in the Fortinet Support Portal to facilitate a professional investigation and diagnosis.