"memory traffic log is 95% full" - Fortigate 200B

[Martín]

This problem persist to me:  "memory traffic log is 95% full", although if i make this commands:

config log memory setting           set diskfull overwrite

Any idea? Thanks!

[Christopher_McMullan · Accepted solution]

That looks properly configured, actually. There are warning thresholds set when the log memory approaches being full. If you have set the FortiGate to overwrite the oldest file once it reaches a certain age or size, it will simply delete the oldest file and open a new one. The threshold alerts shouldn't be anything to get alarmed about.

[Jeff_FTNT · Accepted solution]

It can not disable , but it can change setting at :

config log memory global-setting     set max-size 163840     set full-first-warning-threshold 75     set full-second-warning-threshold 90     set full-final-warning-threshold 95 end

If you increase max-size, it may have less chance to report this event log, thanks.

[Christopher_McMullan · Accepted solution]

That looks properly configured, actually. There are warning thresholds set when the log memory approaches being full. If you have set the FortiGate to overwrite the oldest file once it reaches a certain age or size, it will simply delete the oldest file and open a new one. The threshold alerts shouldn't be anything to get alarmed about.

[Jeff_FTNT · Accepted solution]

It can not disable , but it can change setting at :

config log memory global-setting     set max-size 163840     set full-first-warning-threshold 75     set full-second-warning-threshold 90     set full-final-warning-threshold 95 end

If you increase max-size, it may have less chance to report this event log, thanks.

[Martín]

Jeff_FTNT wrote:

It can not disable , but it can change setting at :

config log memory global-setting    set max-size 163840    set full-first-warning-threshold 75    set full-second-warning-threshold 90    set full-final-warning-threshold 95 end

If you increase max-size, it may have less chance to report this event log, thanks.

Hi Jeff_FTNT, thanks for reply. When i get these "memory traffic log is 95% full" the Fortigate block my GUI conections. If i increase the max-size, i only delays carrying the problem, it will relock. How can avoid this? The logs increase very quickly.

[Jeff_FTNT · Accepted solution]

<When i get these "memory traffic log is 95% full" the Fortigate block my GUI conections.>

That should be a bug, one way you may disable "traffic log " on policy, heavy  traffic log to memory is useless. Thanks.

[Martín]

Jeff_FTNT wrote:

<When i get these "memory traffic log is 95% full" the Fortigate block my GUI conections.>

That should be a bug, one way you may disable "traffic log " on policy, heavy  traffic log to memory is useless. Thanks.

Yes, something is wrong with the firewall, i not use the memory log often, so i'll disabled it, and use only syslog server.

Thanks for reply

[Martín]

  Yes, something is wrong with the firewall, i not use the memory log often. I'll disabled it i use only syslog server.

Thanks for reply

[makco10]

Hello,

Other option is change the inspection mode from Proxy mode to Flow-Based.

Proxy : More security more resources

Flow-based: Less resources but you lose features like DLP.

In the new FortiOS 6.2 you can merge the inspection modes by policy :)

Regards.