FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
WinterSnowYap
Article Id 397347
Description This article describes how to reduce FortiAnalyzer Internal Usage when Internal Usage consumes a lot of disk space.
Scope FortiAnalyzer.
Solution

At FortiAnalyzer, run the CLI command to check Internal Usage:

 

diagnose log device   <----- Internal Usage consumed more than 200 GB.

 

At FortiAnalyzer, run the CLI command to perform a file system check:

 

diagnose system fsck harddisk

 

After FortiAnalyzer has rebooted, run the CLI command to check Internal Usage again:

 

diagnose log device   <----- After reboot, the internal usage consumed will be reduced.