Fortigates local disk retention and thresholds

[myrdin]

Hi,

silly question probably: at some point the local disk on the fortigates will get full (both logs and reports). Where can i find the policy for retention? Does the fortigate have a mechanism that if a threshold is breached it will start deleting old logs and reports?

thanks

[Sylvia · Accepted solution]

Hm, I am not aware of a dedicated retention setting/policy.

There's just:

config log disk setting   set diskfull {nolog | overwrite}

  set full-first-warning threshold   set full-second-warning threshold   set full-final-warning threshold

end

(refer to http://docs.fortinet.com/d/fortigate-fortios-5.2-cli-reference)

Sylvia

[Sylvia · Accepted solution]

Hm, I am not aware of a dedicated retention setting/policy.

There's just:

config log disk setting   set diskfull {nolog | overwrite}

  set full-first-warning threshold   set full-second-warning threshold   set full-final-warning threshold

end

(refer to http://docs.fortinet.com/d/fortigate-fortios-5.2-cli-reference)

Sylvia

[FatalHalt · Accepted solution]

Hey Myrdin,

You can use the settings below to set your thresholds. If you're using a server to roll the logs to, there are some more options that can be used as well. 

config log disk setting
    diskfull (nolog/overwrite) - have the FTG stop logging, or overwrite oldest logs when the disk is full.
    maximum-log-age (#) - Only keeps logs up until they are # of days old.
    log-quota (#) - Maximum size (in MB) of the disk the FTG can use for logging.
end

[myrdin]

legends both of you. 

I cannot see the statement to overwrite with i set, so i suppose that is the default settings and it wont appear.

thanks

[Sylvia]

try show full after config log disk setting.

Then you see ALL settings - including the default ones.