Traffic: Logs and Indexes and Current Retention

noor_sofia — Sat, 19 Aug 2023 21:26:11 GMT

Found our that our FW1 only able to keep 4 days of traffic logs but took more space than FW02 which able to log up to 15 days ( previously FW2 in active for around 2 weeks+)

FW01

FW02

Disk usage:

traffic: Logs and Indexes: 34G Current Retention: 4 days

threat: Logs and Indexes: 18G Current Retention: 6 days

system: Logs and Indexes: 4.7G Current Retention: 837 days

FW01(active)> show system disk-space

Filesystem Size Used Avail Use% Mounted on

/dev/sda3 19G 5.8G 13G 33% /

none 7.7G 60K 7.7G 1% /dev

/dev/sda5 38G 5.2G 31G 15% /opt/pancfg

/dev/sda6 19G 11G 7.0G 61% /opt/panrepo

tmpfs 7.7G 395M 7.3G 6% /dev/shm

cgroup_root 7.7G 0 7.7G 0% /cgroup

/dev/sda8 125G 96G 23G 82% /opt/panlogs

Disk usage:

traffic: Logs and Indexes: 21G Current Retention: 15 days

threat: Logs and Indexes: 16G Current Retention: 19 days

system: Logs and Indexes: 1.6G Current Retention: 1761 days

FW02(passive)> show system disk-space

Filesystem Size Used Avail Use% Mounted on

/dev/sda3 19G 5.6G 13G 32% /

none 7.7G 60K 7.7G 1% /dev

/dev/sda5 38G 5.3G 31G 15% /opt/pancfg

/dev/sda6 19G 10G 7.8G 57% /opt/panrepo

tmpfs 7.7G 395M 7.3G 6% /dev/shm

cgroup_root 7.7G 0 7.7G 0% /cgroup

/dev/sda8 125G 71G 48G 60% /opt/panlogs

Meanwhile, please answer the following question below for further checking:

Have you made any recent changes or is it a new issue? – notice this issue was quite sometimes
Can you give us the picture error of the issue? – There no error, just the days is lower than fw2, need help to check why this behavior
When did this issue happen? – unsure

Re: Traffic: Logs and Indexes and Current Retention

ozheng — Thu, 17 Aug 2023 06:06:30 GMT

Hello Noor_sofia,

I don't know if the techsupport files are shared on purpose or not.
Usually, it is something usable by TAC.
Sharing it here is just exposing your firewalls configuration to a public forum.
The password is encrypted, but a bad actor would be able to trace back to your organisation.

Regarding the query : if the FW2 is the passive, it may be normal.
The current retention is a calculated estimation of the retention based on the amount of traffic (the more session you have, the more logs are generated), and the disk space.

Olivier

topic Traffic: Logs and Indexes and Current Retention in Next-Generation Firewall Discussions

Traffic: Logs and Indexes and Current Retention

Re: Traffic: Logs and Indexes and Current Retention