Sizing Logging

[judit]

Hello, is there a CLI command where I can see how many logs/second are written to the hdd of the fortigate unit? I try to figure out how many logs per second are written, so that I can define the hdd disk size of a VM Ware Fortianalyzer. Thanks.

[ede_pfau]

Maybe this can help:

 gate # diag test app mig -1
 1. Toggle fast log option
 2. Show global log setting
 3. Show vdom log setting
 4. Show active log devices
 5. Show MAX file descriptor number
 6. Dump statistics
 7. Show dynamic profile cache
 100. Dump vdom-root log setting
 
 gate # diag test app mig 6
 mem=613856, disk=0, alert=16, alarm=0, sys=0, faz=0, webt=0, fds=0
 compose-compact=615333, interface-missed=452002
 

I think these values are total counts since last reboot. In this example FGT I' m logging into memory, so 613856 is the count of log events of 9.5 days.

[emnoc]

is there a CLI command where I can see how many logs/second are written to the hdd of the fortigate unit

Why would you do that? Depending on the events you are logging and the number of events the loggingsize could be greatly impacted. A slow unit on a slow day my askew the logs/second rates imho. What I did to compute my logging size was to use a remote-syslog and track the number of events per-day, per-week, per-month and then I compute the size of the data per-day/week/month. Than we used that as based for determine just how much logging. We avg between 400-500megs per-day per fortigate btw. Some days is much higher and other days it' s much less. You can take it even further and look at the type/serverity of the event and break it down by types of logged information. BTW, you can use logwatch to help even further compute the above or build your own script to do the same.