Description
This article describes how to understand Quota (Space to Logs and Database) configuration in FortiAnalyzer 5.4.x and higher.
Scope
FortiAnalyzer.
Solution
Analytics Policy overview (GUI).
- Location in GUI: System -> Storage Info.
- Total quota example: The device is assigned 1 GB total log-storage quota.
- 70% allocated to the Analytics/database (DB).
- 30% allocated to Archive/Logs (raw log area).
- 'Edit Log Storage Policy – ADOM: Pedro_54' shows:
- Keep logs for Analytics: 60 days.
- Keep logs for Archive: 365 days.
- Disk Utilization highlights:
- Maximum Allowed: 1000 MB (the policy quota for that device/ADOM scope).
- Out of Available: 4.9 TB (the physical disk space on the FortiAnalyzer).
- Analytics: Archive split: 70% / 30% (how the 1000 MB is divided).
- Alert and Delete when usage reaches: 90% (cleanup threshold).
- Key behavior: If Analytics DB or Archive usage reaches the configured quota before the configured retention expires, FortiAnalyzer deletes the oldest logs first to remain within quota.
'diagnose log device' with Analytics Policy usage:
This screenshot shows FortiAnalyzer CLI output 'diagnose log device' and an Analytics Policy graph.
Top summary for ADOM 'Pedro_54':
- Logs (Archive/raw):
- Retention: 365 days.
- Quota: 300.0 MB.
- UsedSpace: 6.9 MB.
- Used%: 2.3%.
- Database (Analytics DB):
- Retention: 60 days.
- Quota: 700.0 MB.
- Used: 363.9 MB.
- Used%: 52.0%.
Analytics policy section:
- '52% Quota Used' corresponds to Analytics DB utilization:
- 363.9 MB / 700 MB = 52.0%.
- 'Max. Quota = 700MB' indicates the hard cap for the Analytics DB under this policy.
- 'Keep logs for 60 days / Actual logs for 51 days' means:
- Configured retention target is 60 days, but currently only ~51 days exist in the Analytics DB.
- This usually happens when logging started ~51 days ago, or older data was previously purged/reset/migrated.
- Practical takeaway: The analytics DB is about half full - if it hits the 700 MB quota before reaching 60 days of history, the oldest analytics data will be deleted and 'Actual days' will stop increasing.
Data Policy (retention settings):
This is the 'Edit Log Storage Policy – ADOM: Pedro_54' -> Data Policy section:
- Keep Logs for Analytics: 60 Days.
- Target retention for Analytics database data (reports, charts, analytics queries).
- Keep Logs for Archive: 365 Days.
- Target retention for Archive/raw logs (longer-term storage).
- Important: These are retention targets; actual retained days depend on whether the allocated quota is sufficient for the log volume. If quota fills first, FortiAnalyzer deletes the oldest data.
Archive Policy overview (GUI).
This screenshot emphasizes the Archive (raw logs) side of the Log Storage Policy.
- Maximum Allowed: 1000 MB.
- Total quota allocated for this device/policy scope in the example.
- Out of Available: 4.9 TB.
- Total physical disk space available on FortiAnalyzer.
- Even if the disk has TBs free, the ADOM/device is constrained by the configured quota.
- Analytics: Archive = 70% / 30%.
- From the 1000 MB quota:
- 700 MB for Analytics DB.
- 300 MB for Archive/Logs.
- From the 1000 MB quota:
- Alert and Delete when usage reaches: 90%.
- Threshold to begin cleanup behavior.
- Key behavior: If Archive usage reaches quota before the configured 365-day retention, FortiAnalyzer purges the oldest archived logs first, reducing achievable retention.
'diagnose log device' with Archive Policy usage.
This screenshot shows the same CLI command output focusing on Archive (Logs) usage and an Archive Policy graph.
For ADOM 'Pedro_54':
- Logs/Archive:
- Retention: 365 days.
- Quota: 300.0 MB.
- UsedSpace: 6.9 MB.
- Used%: 2.3% (displayed as ~2% in the graph badge).
- Breakdown: logs 2.1 MB, content/IPS 4.8 MB, others 0.
Archive Policy section:
- '2% Quota Used' reflects the calculation:
- 6.9 MB / 300 MB ≈ 2.3%.
- 'Max. Quota = 300MB' is the hard cap for Archive/Logs under this policy.
- 'Keep Logs for 365 Days / Actual Logs for 21 Days' means:
- Retention target is 365 days, but only ~21 days currently exist.
- Most commonly due to recent start of logging, or previous purge/reset/migration.
- Practical takeaway: Archive storage is not under pressure (only ~2% used). Actual days should increase over time until either 365 days is reached or the 300 MB quota becomes the limiting factor.
Related articles:
