FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 365015
Description This article describes how to change the disk utilization threshold on the health page.
Scope FortiSIEM.
Solution

By default, the Admin-> Health -> Cloud Health page shows a disk in warning state when the usage of the disk is over 65 per cent.

This is important to check the disk usage to avoid FortiSIEM failures.

However, in some cases and especially with hardware devices, even after a deep cleaning of the disk, the normal usage remains above that limit of 65 percent.

In that case, it is possible to modify this threshold to avoid having the warning status displayed by following the next steps:

 

  1. Log in to the FortiSIEM super CLI as root.

 

  1. Check the current disk usage status:

/opt/phoenix/phscripts/bin/get-fsm-metrics.py --enable-only "diskUsage" -j /tmp/disk_test.json
- diskUsage ........................................ succeeded.

cat /tmp/disk_test.json | python -m json.tool

{
"currentTime": 1734360221,
"nodeType": "Super",
"healthSummary": {
"summary": "Warning",
"reason": [
{
"attribute": "Disk Utilization",
"value": "Warning",
"reason": "Disk / Utilization between 65% and 85%"
}...

 

  1. Edit the get-fsm-metrics.py file manually

vi /opt/phoenix/phscripts/bin/get-fsm-metrics.py

 

  • Search for DISK_UTIL_LOW attribute that should be at line 140.
  • Modify line from:

DISK_UTIL_LOW=65

to

DISK_UTIL_LOW=75

 

  • Save using "Esc :wq"

 

  1. Check the disk usage status again:

/opt/phoenix/phscripts/bin/get-fsm-metrics.py --enable-only "diskUsage" -j /tmp/disk_test.json
- diskUsage ........................................ succeeded.

cat /tmp/disk_test.json | python -m json.tool
{
"currentTime": 1734360928,
"nodeType": "Super",
"healthSummary": {
"summary": "Normal",
"reason": [
{
"attribute": "Disk Utilization",
"value": "Normal",
"reason": "All Disk Utilization less than 75%"
}...

 

  1. Check in the GUI under Admin -> Health -> Cloud Health

disk_threshold.PNG

 

 

Contributors