Exceed log rate per second on FAZ VM

[Ron_Uss]

Hello gyus,

on our FAZ-VM-BASE I found message "Log rate (xxx logs/second) exceeds the peak limit (50 logs/second) over the last 30 minutes." I think, that licensing on VM is about logs/day and storage and limit logs/sec is only for HW FAZ (according to data sheet).

So what exactly this message means? Is only information about amount of peak of logs or some limits for this VM?

Many thanks

[chall_FTNT · Accepted solution]

The peak limit is a value derived from the logs/day licensing.  Although exceeding peak limit is permitted, if this peak limit is consistently exceeded, it is an early warning that you are at risk of exceeding the daily licensed limit.

To see the derived limits: (sample output) FortiAnalyzer # get sys loglimits GB/day : 1 Peak Log Rate : 50       #<--- derived value Sustained Log Rate : 30     #<--- derived value

[Ron_Uss]

Thank you, Chall!

[seadave]

Sure seems like a hard limit is in place.  Our FAZ rate graphs look for all intents and purposes as if they are being limited at ~130 with only the occasional peak deviation.  It can be much less during off-peak hours, but appears to "clip" at 130 during the workday.  We are licensed on the VM for 2G/day and 1TB.  I have 8 cores and 16G of RAM allocated to the VM.  NICS are VMXNET3 over 10G links.