FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Article Id 196380
This article describes how to change the device quota after FortiAnalyzer (FAZ) is upgraded from v5.2 to v5.4.

Quota assignment in
FAZ v5.2 is done for each device and not by ADOM.
From v5.4, quota assignment shifted to ADOM basis.
After upgrading to v5.4, both device quota and ADOM quota are active and device quota takes precedence.

The 'Total Allocated Quota is bigger than Total Quota' warning is seen in the following condition:
  -  FAZ was on v5.2 where the quota allocated for devices is equal to overall disk space on the unit.
  -  After the unit is upgraded to v5.4, the quota assignment gets converted to ADOM basis which now exceeds the overall disk space available on the unit.

Example of the warning seen as output of the command "diag log device":
Total Quota Summary:
*** Warning: Total Allocated Quota is bigger than Total Quota! Please check the configuration of devices!
    Total Quota      Allocated        Available        Allocate%
    157.7GB          173.7GB          0.0KB            110.1%

1. To correct this, run the following command:
 #exec log device disk-quota All 0
This is going to reset the device quota to unlimited.

2. On the Gui, under System Settings > Storage Info, change the quota assigned to each ADOM as per requirement.