Fortigates local disk retention and thresholds

Forum|Forum|11 years ago
July 29, 2015
4 replies
9780 views

Hi,

silly question probably: at some point the local disk on the fortigates will get full (both logs and reports). Where can i find the policy for retention? Does the fortigate have a mechanism that if a threshold is breached it will start deleting old logs and reports?

thanks

Best answer by Sylvia

Hm, I am not aware of a dedicated retention setting/policy.

There's just:

config log disk setting set diskfull {nolog | overwrite}

set full-first-warning threshold set full-second-warning threshold set full-final-warning threshold

end

(refer to http://docs.fortinet.com/d/fortigate-fortios-5.2-cli-reference)

Sylvia

SylviaAnswer

Explorer

Hm, I am not aware of a dedicated retention setting/policy.

There's just:

config log disk setting set diskfull {nolog | overwrite}

set full-first-warning threshold set full-second-warning threshold set full-final-warning threshold

end

(refer to http://docs.fortinet.com/d/fortigate-fortios-5.2-cli-reference)

Sylvia

FatalHalt

New Member

Hey Myrdin,

You can use the settings below to set your thresholds. If you're using a server to roll the logs to, there are some more options that can be used as well.

config log disk setting
    diskfull (nolog/overwrite) - have the FTG stop logging, or overwrite oldest logs when the disk is full.
    maximum-log-age (#) - Only keeps logs up until they are # of days old.
    log-quota (#) - Maximum size (in MB) of the disk the FTG can use for logging.
end