Space overflow notification for ADOM FortiAnalyzer 6.4.13

[gertyl]

Hi, dear community.
We are facing the following problem:
We have FortiAnalyzer v6.4.13 and have been receiving the following notifications for several days: Disk usage for Adom XXX has reached the delete threshold of 90% of total 50.0GB. Archive Usage at 89.6% (13.4GB) and Analytics Usage at 90.3% (31.6GB).
I read that the logs should be automatically deleted after this message. But I don't think so, because we received a notification before that: Disk usage for Adom XXX has reached the delete threshold of 90% of total 50.0GB. Archive Usage at 88.8% (13.3GB) and Analytics Usage at 91.0% (31.9GB).
Please tell me if we should do something about it. Because the messages are coming every day and we don't want our storage to be full.

Best regards.

[Jean-Philippe_P]

Hello gertyl, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello again gertyl,

I found this solution. Can you tell me if it helps?

To address the issue of disk usage reaching the delete threshold on your FortiAnalyzer, follow these steps:

1. Expand Disk Space: If possible, expand the disk space or add an HDD to accommodate more data. For virtual machines, refer to the guide on extending disk space in FortiAnalyzer-VM.
   
   
2. Increase ADOM Quota: Edit the ADOM settings to allocate more disk space if available. This can help manage the storage more effectively.
   
   
3. Optimize Log Handling: Reduce the volume of logs being sent to FortiAnalyzer by minimizing unnecessary logging from FortiGate devices. This can be done by adjusting the logging settings on the FortiGate.
   
   
4. Monitor Log Rate: Use the command `diagnose fortilogd lograte` to monitor the log rate per second and identify any devices sending excessive logs. Adjust the logging settings on those devices if necessary.
   
   
5. Adjust Data Retention Policies: Review and adjust the data retention policies to ensure that logs are retained only as long as necessary, which can help free up space.
   
   
6. Regular Monitoring: Continuously monitor the storage utilization and log rates to proactively manage disk space and prevent reaching critical thresholds.
   
   

Implementing these steps should help manage your storage effectively and prevent the storage from becoming full.