traffic log database exceeds alarm threshold value 100% of total allowed size

Zorgnet — Thu, 15 Feb 2024 12:10:31 GMT

Hello community,

On my paloalto 850 I get several alarms every day stating:

"Current suz (xxxMB) of traffic log database exceeds alarm threshold value (100%) of total allowed size (xxxMB).

On the CLI a "show system disk-space" shows the disk on not full:

Filesystem Size Used Avail Use% Mounted on
/dev/root 9.5G 3.4G 5.6G 38% /
none 2.5G 68K 2.5G 1% /dev
/dev/sda5 19G 5.6G 13G 31% /opt/pancfg
/dev/sda6 7.6G 3.6G 3.7G 50% /opt/panrepo
tmpfs 2.5G 361M 2.2G 15% /dev/shm
cgroup_root 2.5G 0 2.5G 0% /cgroup
/dev/sda8 173G 141G 24G 86% /opt/panlogs

How could I solve this?

Pan-os 10.1.10-h2

Jan

Re: traffic log database exceeds alarm threshold value 100% of total allowed size

kiwi — Thu, 15 Feb 2024 13:32:41 GMT

Hi @Zorgnet ,

Disk-space is not the same as the threshold value you have set on the different log databases.

The device will start overwriting the oldest logs automatically once you reach the quota. So the drive will always be around the quota size as the logs will roll round.

The device will be writing logs to the drive even if you have a log forwarding profile set up but you can always export the logs and then delete them from the device to clear some space.

Logging at session end is a good way of cutting down on logs generated (instead of logging at session start and end).

Execute the below CLI command to view your quotas.

> show system logdb-quota

Please refer to the below links to know to more about this exact behavior and how to eliminate alarm message:

Alarm "Current size of traffic log database exceeds alarm threshold value of total allowed size"

How to Eliminate Alarm Message: Log Database Exceeds Alarm Threshold Value

Kind regards,

-Kim.

topic Re: traffic log database exceeds alarm threshold value 100% of total allowed size in General Topics

traffic log database exceeds alarm threshold value 100% of total allowed size

Re: traffic log database exceeds alarm threshold value 100% of total allowed size