PCAPs storage location

[FortiBrian]

Does anyone know where PCAPs are stored on the FAZ. We are wanting to see how much space they are taking up? Thanks! -brian

[L_FTNT]

which version of FAZ you are running?

[FortiBrian]

Running v5.0.7-build0321 140627 (GA) as a Collector

[scao_FTNT]

Hi, Brian: you may use below CLI to check archive file space usage on FAZ FAZ1000C # diagnose log device Device Name Device ID Used Space(logs/database/quar/content/IPS) Allocated Space % Used FGT60CHA_a FGHA001008075082_CID 174MB(51 / 122 / 0 / 1 / 0 ) 1000MB 17.40% |- HA clsuter member: FGT60C3G10002861 |- HA clsuter member: FGT60C3G10004221 FGT_1240B FGT1KB3909601020 205955MB(15282/ 18962/ 2 / 168868/ 284 1) 300000MB 68.65% ccccc FGHA001945776936_CID 941MB(332 / 440 / 0 / 169 / 0 ) 1000MB 94.10% |- HA clsuter member: FGVM04FA10000002 |- HA clsuter member: FGVM04FA10000001 200B_2 FG200B3910601180 4133MB(2087/ 2041/ 0 / 0 / 5 ) 10000MB 41.33% ... and you can also configure in System Settings - Advanced - File Management to auto remove old files Thanks Simon

[FortiBrian]

Great! Thanks for the information.

[mani]

Hi Simon - I see under " Used Space" they break down the usage by logs, database, quarantine, content, IPS... Unfortunately, I do not see a breakdown of the PCAPs specifically. Does this fall under IPS? Thanks!

[L_FTNT]

I believe the answer is Yes.

Device Name Device ID Used Space(logs/database/quar/content/IPS)

As I understand, the details for each field as follows: logs - the space used by raw Logs database - database size quar - space used by quarantined files content - the space used by DLP Archive files IPS - the space used by IPS Packets

[scao_FTNT]

Yes, IPS packets are PCAP files on FAZ Thanks Simon