Technical Tip: How to Modify FortiSIEM Disk Utilization Alert Thresholds

Description

This article describes how to change system-generated disk utilization alerts are triggered based on predefined disk usage threshold values configured in the script. 

Scope

FortiSIEM.

Solution

Configuration exist in file /opt/phoenix/phscripts/bin/get-fsm-metrics.py.

The following parameters control the alert severity:

• DISK_UTIL_LOW = 75.

• DISK_UTIL_HIGH = 85.

Where:

• DISK_UTIL_LOW = Warning threshold.

• DISK_UTIL_HIGH = Critical threshold.

These values can be modified to suit environment requirements.

Run the following command to check status:

grep "DISK_UTIL_" /opt/phoenix/phscripts/bin/get-fsm-metrics.py

Example output:

• DISK_UTIL_LOW = 75

• DISK_UTIL_HIGH = 85

Prepare a backup:

cp /opt/phoenix/phscripts/bin/get-fsm-metrics.py \
/opt/phoenix/phscripts/bin/get-fsm-metrics.py.bkp

Modify the values from command:

Set Warning threshold to 80.

Set Critical threshold to 90.

sed -i 's/DISK_UTIL_LOW = .*/DISK_UTIL_LOW = 80/g' \
/opt/phoenix/phscripts/bin/get-fsm-metrics.py
sed -i 's/DISK_UTIL_HIGH = .*/DISK_UTIL_HIGH = 90/g' \
/opt/phoenix/phscripts/bin/get-fsm-metrics.py

Verification:

grep "DISK_UTIL_" /opt/phoenix/phscripts/bin/get-fsm-metrics.py

Expected output:

• DISK_UTIL_LOW = 80.

• DISK_UTIL_HIGH = 90.

Notes:

• Ensure thresholds are configured according to available disk capacity and monitoring requirements.

• Incorrect threshold values may generate excessive alerts or delay disk usage notifications.

• It is recommended to keep a sufficient gap between warning and critical thresholds.