Log size exceeded over 7 Days

[Si600]

Hi all, new Fortigate user here.  Looking at our Fortianalyzer we have the error You have exceeded your daily logs GB/day licensing limit within the last 7 days.

I've been through this forum and done some Google-Fu, so far so normal.  However, and I only saw this just now, the dates are totally wrong.

This is where Google-Fu fails me and I call upon the experts to assist.  Any ideas?

Cheers,

Simon.

[ozkanaltas]

Hello @Si600 ,

I think these values and dates are wrong. Because 12TB logs for one is too much, this is not normal. 

Can you try rebooting your FortiAnalyzer instance? 

If you have a valid support contract you can create a ticket to the support team. They will inspect the problem deeply. I say that because this situation is not normal. 

[Si600]

Hi @ozkanaltas,

Thanks for the suggestion, unfortunately it didn't make a difference.  I've raised an official support ticket.

I'll update the thread with whatever they come back with.

Simon.

[Team-IT · Accepted solution]

You are exceeding your license - this is for sure. But those dates and the "daily gb" seems to be buggy hard coded, cause i see them on ALL installations always with the same dates :) So i guess you can ignore them, but when you click on the "thre bar menu" in the widget "license information" next to "GB/Day" you see the real values.

[Si600]

Hi all.  Thanks to @Team-IT for the info that "they all do that, sir!" 

After I started looking into we we found that we were logging *everything* so we had a bit of a prune and since Friday haven't exceeded our limit.  I suspect it hadn't been considered at installation. No matter, we're on track for no errors by next Thursday :)

I have had nothing useful back from Forti Support, just links to the log size trouble shooting in the knowledge base.

[Si600]

I have had a response from Fortigate Support.  It's been escalated about three times so far and as reported by @Team-IT they do indeed all do it. It's a bug in FAZ 7.4.3, BugID#1060397 if anyone is interested.  Due to be fixed in 7.4.4.