Disk usage reaches 81%-Fortigate 200B-

[missbleu]

Hello community, I have a fortigate 200B v5.0,build0128. In two months, the disk usage reaches 81%. Please, I need to know how can I clean old logs in order to reduce the disk usage and how can I set a day limit (for example every 60days) to clean old logs. I' m grateful for your help.

[ede_pfau]

You can configure several aspects: 1. configure what the FGT does when the log disk is full 2. configure the maximum log file age Note that #2 will not necessarily prevent a full disk! Now the How-To: 1. connect to the FGT via the Web GUI 2. click into the Console widget to get a command line 3. on the command line, enter this:

 config log disk setting
 set diskfull {nolog | overwrite}
 end

meaning: if set to ' nolog' , logging will stop completely when the disk is full; if set to ' overwrite' the oldest log files will be deleted when the disk is full - leave out the ' { }' s! 4. and the age:

 config log disk setting
 set maximum-log-age <days_int>
 end

If set to 60, log files older than 60 days will be deleted. I' m not sure whether the max. age refers to log entries (rows) or log files (containing thousands of rows). Fortinet writes of ' logs' whatever that means. Shouldn' t make much of a difference if you have a lot of log events per day.

[missbleu]

Thank you so much for your reply I did configure the FGT to overwrite when the log disk is full. But when I tried to limit the maximum log file age I couldn' t find the command " set maximum-log-age <days_int>" . I have a fortigate 200B v5.0,build0128 Thanks

[ede_pfau]

The commands quoted are taken directly from the v5 CLI Reference. Open the Console widget, on the command line type

 config log disk setting 
  set maximum-log-age 60
  end

If that doesn' t work, what is the exact error message? You can try to explore which options you have by typing

 config log disk setting 
  set m?
  end

When you enter a quotation mark the OS will print out all possible matching commands or options at that point. One more, the 200B has to have an internal disk (a FSM option). Otherwise, you can only log to memory and that doesn' t have the maximum-age option.

[missbleu]

There is no error message just I couldn' t find the command. This is the output of " set m? " FW (setting) # set m? max-log-file-size max log file size in MB before rolling (may not be accurate all the time) max-policy-packet-capture-size max size of policy sniffer in MB, 0 means no limit. ms-per-transaction Maximum pending time (ms) for a transaction (10-60000), the default is 1000

[ede_pfau]

The option should be there. Can you upgrade from 5.0.0 to the most recent 5.0.5? Can anybody confirm that in 5.0.0 (5.0 GA, build 128) the ' maximum-log-age' parameter is available or not?

[missbleu]

Hello, I have upgraded the fortigate to V5.0.5 and I set the maximum-log-age to 20 days but the disk usage didn' t decrease or change. Please I want to find a way to delete the old Logs? Thanks

[ede_pfau]

You can list and delete log files from the CLI (console window or ssh client). See here http://docs.fortinet.com/d/cli-reference-online for the command ' execute log' . ' exec log list' ' exec log delete-rolled <from> <to>' ' exec log delete-oldlogs' if you have upgraded from a previous FortiOS version etc. Most likely you will find most log files in the ' traffic' category.