fortianalyzer with v5.0.7 firmware

[m_SEA]

what is root cause of automatically deleting elog file on fortianalyzer !?!?!

[scao_FTNT]

you mean for the FAZ system local log elog file or its received FGT elog file

for system local log, there has a disk usage check and default is 80%, if over 80%, then it starts to delete old elog file and only keep the current active one

get system locallog disk setting status              : enable ... diskfull            : overwrite log-disk-full-percentage: 80

for device log file, after device configured quota reached, FAZ will start to delete oldest raw log files if device configured for overwrite

Thanks

Simon