FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Description This article describes how to change the device quota after FortiAnalyzer (FAZ) is upgraded from v5.2 to v5.4.
Quota assignment in FAZ v5.2 is done for each device and not by ADOM. From v5.4, quota assignment shifted to ADOM basis. After upgrading to v5.4, both device quota and ADOM quota are active and device quota takes precedence.
Scope The 'Total Allocated Quota is bigger than Total Quota' warning is seen in the following condition: - FAZ was on v5.2 where the quota allocated for devices is equal to overall disk space on the unit. - After the unit is upgraded to v5.4, the quota assignment gets converted to
ADOM basis which now exceeds the overall disk space available on the
unit.
Example of the warning seen as output of the command "diag log device":
Total Quota Summary: *** Warning: Total Allocated Quota is bigger than Total Quota! Please check the configuration of devices! Total Quota Allocated Available Allocate% 157.7GB 173.7GB 0.0KB 110.1%
Solution 1. To correct this, run the following command:
#exec log device disk-quota All 0
This is going to reset the device quota to unlimited.
2. On the Gui, under System Settings > Storage Info, change the quota assigned to each ADOM as per requirement.
