Troubleshooting Tip: Getting 'Disk log has rolled' message in logs

[dkochhar]

Description	This article describes details about the 'Disk log has rolled' log entry.
Scope	FortiGate.
Solution	The GUI shows the following log entry: devid="FG100D3XXXXXX" logid="0100032011" type="event" subtype="system" level="notice" vd="root" eventtime=1641945601 logdesc="Disk log rolled" action="roll-log" reason="file-size" log="elog" msg="Disk log has rolled." Run the following command to confirm the log settings: config log disk setting dia sys logdisk usage FGT # config log disk setting set status enable set maximum-log-age 7      <- Max log age is set to 7 Days set upload disable set max-log-file-size 20    <- Max log file is set to 20MB set roll-schedule daily     <- Disk roll is set to daily set roll-time 00:00 set diskfull overwrite      end FGT # dia sys logdisk usage Total HD usage: 113430MB(108176MiB)/471491MB(449649MiB) Total HD logging space: 353617MB(337236MiB) HD logging space usage for vdom "root": 112856MB(107628MiB)/353617MB(337236MiB) FortiGate systems reserve about 25% of disk space for system utilities and possible quota overflows, ensuring that roughly 75% of the disk space is available for log storage. When the generated logs exceed 20 MB, FortiGate will move the file to the achieve on the disk and create a new log file. This is the expected behavior.