Skip to main content
smxko
Visitor III
November 1, 2024
Solved

FortiAnalyzer ADOM not using Storage

  • November 1, 2024
  • 1 reply
  • 1249 views

Hi,

I've set the Data Policy for my root ADOM to 120 days for Analytic logs. All my Fortigates are in that ADOM. However, when I view the logs, there are only logs available for the last 61 days. It never exceeds 61 days plus a few hours, even though the ADOM root has 40 % of unused storage. The analytic / archive ratio is set to 75 / 25. Do you know what I'm doing wrong? I'd expect it to fill the storage until it's full or the data policy is met but it doesn't do any of that.

I also tried rebuilding the SQL DB. It seemed to be working at first, since logs for analytics reached 61 and 20 hours but after 00:00, it reset itself to 61 days and 0 hours. After the rebuild it freed up some space and ADOM root now even has 55 % of unused storage but is stil not logging according to the policy.

 

Screenshot 2024-10-25 101637.pngScreenshot 2024-10-25 101752.png

Thanks in advance

Best answer by mrafat

Hi , 
Please check and review the settings below :
Go to system settings > Advanced > Device log settings > and make sure that in Automatically delete section , the number of days chosen there are more than 61 days 

1 reply

mrafat
Staff
mrafatAnswer
Staff
November 3, 2024

Hi , 
Please check and review the settings below :
Go to system settings > Advanced > Device log settings > and make sure that in Automatically delete section , the number of days chosen there are more than 61 days 

smxko
smxkoAuthor
Visitor III
November 4, 2024

Thanks, it was actually set to 60 days.