Troubleshooting Tip: Resolving Disk Warning Alerts for /opt in FortiSIEM

To resolve disk warning alerts on FortiSIEM, follow these steps:

1. Check the disk usage on the /opt volume by running the command:

sudo du --max-depth=4 -xh /opt | sort -hr | head -n 30 <----- This will help identify the directories and files consuming the most disk space.

2. Investigate the /MachineLearning/ directory, as it may be filling up the /opt drive due to temporary files created by Machine Learning. Check if there are any Machine Learning jobs enabled in the FortiSIEM GUI by going to Resources -> Machine Learning Jobs.
   
   
3. If no Machine Learning jobs are enabled, it is safe to remove some of the files to increase disk space. Even though there is a cron job schedule in /etc/cron.d/fsm-crontab to run the phMLCacheCleaner.py, manual script running is possible with the command below:

python3.9 /opt/phoenix/phscripts/bin/phMLCacheCleaner.py

4. To increase the frequency of the phMLCacheCleaner.py script, review the /etc/cron.d/fsm-crontab file and adjust the schedule as needed.

Related articles:

Technical Tip: How to change disk utilization threshold on Health page