Technical Tip: How to configure FortiAnalyzer local event log interval for device offline, disk full and gb/day limit exceeded events

[jpatel]

Description

This article describes how to configure the local event log interval of FortiAnalyzer for the following three events:

1. Device offline i.e. FortiAnalyzer didn’t receive a log from the device in the last xx minutes.
2. Disk full.
3. GB/Day limit exceeded. 

And how to configure the percentage of disk usage that triggers disk full.

Scope

FortiGate.

Solution

The configuration can only be done via FortiAnalyzer CLI using the following commands

config system locallog setting
set log-interval-dev-no-logging <x> # <----- Interval setting for device offline event.
set log-interval-disk-full <x>      # <----- Interval setting for disk full event.
set log-interval-gbday-exceeded <x> # <----- Interval setting for GB/day limit exceeded event.
...
set log-interval-disk-full <y> #<-- disk usage which triggers disk full
 
end     

Note:

• The value x is the interval in minutes, the range should be [5-2880] or '0' as disabled.
• The value y is the percentage as an integer [0-100] where 80 is the default.