Skip to main content
judit
New Member
August 7, 2014
Question

Sizing Logging

  • August 7, 2014
  • 2 replies
  • 11048 views
Hello, is there a CLI command where I can see how many logs/second are written to the hdd of the fortigate unit? I try to figure out how many logs per second are written, so that I can define the hdd disk size of a VM Ware Fortianalyzer. Thanks.

    2 replies

    ede_pfau
    SuperUser
    SuperUser
    August 7, 2014
    Maybe this can help:
     gate # diag test app mig -1  1. Toggle fast log option  2. Show global log setting  3. Show vdom log setting  4. Show active log devices  5. Show MAX file descriptor number  6. Dump statistics  7. Show dynamic profile cache  100. Dump vdom-root log setting    gate # diag test app mig 6  mem=613856, disk=0, alert=16, alarm=0, sys=0, faz=0, webt=0, fds=0  compose-compact=615333, interface-missed=452002  
    I think these values are total counts since last reboot. In this example FGT I' m logging into memory, so 613856 is the count of log events of 9.5 days.
    emnoc
    New Member
    August 7, 2014
    is there a CLI command where I can see how many logs/second are written to the hdd of the fortigate unit
    Why would you do that? Depending on the events you are logging and the number of events the loggingsize could be greatly impacted. A slow unit on a slow day my askew the logs/second rates imho. What I did to compute my logging size was to use a remote-syslog and track the number of events per-day, per-week, per-month and then I compute the size of the data per-day/week/month. Than we used that as based for determine just how much logging. We avg between 400-500megs per-day per fortigate btw. Some days is much higher and other days it' s much less. You can take it even further and look at the type/serverity of the event and break it down by types of logged information. BTW, you can use logwatch to help even further compute the above or build your own script to do the same.