Description
This article describes how to configure the local event log interval of FortiAnalyzer for the following three events
- Device offline i.e. FortiAnalyzer didn’t receive a log from the device in the last xx minutes.
- Disk full.
- GB/Day limit exceeded.
And how to configure the percentage of disk usage which triggers disk full.
Scope
FortiGate.
Solution
The configuration can only be done via FortiAnalyzer CLI using following commands
config system locallog setting
set log-interval-dev-no-logging <x> #< -- Interval setting for device offline event
set log-interval-disk-full <x> #<-- Interval setting for disk full event
set log-interval-gbday-exceeded <x> #<-- Interval setting for gb/day limit exceeded event
...
set log-interval-disk-full <y> #<-- disk usage which triggers disk full
end
Note:
The value x is the interval in minutes, the range should be [5-2880] or '0' as disabled.
the value y is the percentage as an integer [0-100] where 80 is the default.
