Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
myrdin
New Contributor

Fortigates local disk retention and thresholds

Hi,

 

silly question probably: at some point the local disk on the fortigates will get full (both logs and reports). Where can i find the policy for retention? Does the fortigate have a mechanism that if a threshold is breached it will start deleting old logs and reports?

 

thanks

 

2 Solutions
Sylvia
Contributor II

Hm, I am not aware of a dedicated retention setting/policy.

 

There's just:

config log disk setting   set diskfull {nolog | overwrite}

  set full-first-warning threshold   set full-second-warning threshold   set full-final-warning threshold

end

(refer to http://docs.fortinet.com/d/fortigate-fortios-5.2-cli-reference)

 

Sylvia

View solution in original post

FatalHalt
Contributor II

Hey Myrdin,

 

You can use the settings below to set your thresholds. If you're using a server to roll the logs to, there are some more options that can be used as well. 

 

config log disk setting
    diskfull (nolog/overwrite) - have the FTG stop logging, or overwrite oldest logs when the disk is full.
    maximum-log-age (#) - Only keeps logs up until they are # of days old.
    log-quota (#) - Maximum size (in MB) of the disk the FTG can use for logging.
end

View solution in original post

4 REPLIES 4
Sylvia
Contributor II

Hm, I am not aware of a dedicated retention setting/policy.

 

There's just:

config log disk setting   set diskfull {nolog | overwrite}

  set full-first-warning threshold   set full-second-warning threshold   set full-final-warning threshold

end

(refer to http://docs.fortinet.com/d/fortigate-fortios-5.2-cli-reference)

 

Sylvia

FatalHalt
Contributor II

Hey Myrdin,

 

You can use the settings below to set your thresholds. If you're using a server to roll the logs to, there are some more options that can be used as well. 

 

config log disk setting
    diskfull (nolog/overwrite) - have the FTG stop logging, or overwrite oldest logs when the disk is full.
    maximum-log-age (#) - Only keeps logs up until they are # of days old.
    log-quota (#) - Maximum size (in MB) of the disk the FTG can use for logging.
end

myrdin
New Contributor

legends both of you. 

 

I cannot see the statement to overwrite with i set, so i suppose that is the default settings and it wont appear.

 

thanks

Sylvia
Contributor II

try show full after config log disk setting.

Then you see ALL settings - including the default ones.

Labels
Top Kudoed Authors