FAZ 200D You have exceeded your daily GB Log/Day within 7 Days

[obika]

Hey Guys, What could be the major reason why i keep getting this notification on a FAZ 200D. The FAZ 200D was configured to pull logs from two FG' s (1000C and 3810B) both in HA mode each time i log in to the Fortianalyzer i get welcomed with this notification. Find attached, screenshot and advice how you where able resolve. Obika FCNSP V5

[rwpatterson]

Welcome to the forums. From what I recall, the FAZ model numbers were supposed to be close to (or higher than) the FGT models for logging to work. The 200C (more than likely) is way underpowered for the amount of data you' re throwing at it. Someone please chime in and tell me something different.

[pcraponi]

FortiAnalyzer have a hardware limitation of log received per day... 200D supports 5GB/day (7 day rolling average)... In your case, you need a FortiAnalyzer 300D or a VM version VM-GB25 Regards, Paulo Raponi

[obika]

Thanks Paulo for your input,perharps getting a VM version or even getting another FAZ seems to be out of the equation, is there any h/w upgrade or any work around to this apart from going that route. Regards Obika

[pcraponi]

Or you can disable some logs that consume disk... like Traffic on some policies... App.Control and WebFilter... DLP...

[AtiT]

Hi, we are using Fortianalyzer VM and I remember that I saw similar (or the same?) message when more logs (GB/day) were used than the allowed logs. I could this check on the dashboard under Licence information widget where is info about the: GB/Day of Logs Allowed GB/Day of Logs Used I have a FAZ-100C in the LAB and there is a limitation: 5 GB/Day of Logs Allowed. On FAZ VM it is about the licence you purchased, on hardware FAZ unit probably the hardware limitation - I' m not sure.