topic Re: SYSTEM ALERT : high : Number of hints on disk has exceeded 5000 due to log forward failures in General Topics

SYSTEM ALERT : high : Number of hints on disk has exceeded 5000 due to log forward failures

kvagenas — Wed, 29 May 2024 12:21:27 GMT

Hello I receive many alerts with subject SYSTEM ALERT : high : Number of hints on disk has exceeded 5000 due to log forward failures. I do not have panorama (never did). Is there a way for these alerts to stop.

Below is the alert i received from email.

domain: 1
receive_time: 2024/05/29 13:18:52
serial: xxxxxxxxxx
seqno: 7373667907529615763
actionflags: 0x0
type: SYSTEM
subtype: general
config_ver: 2561
time_generated: 2024/05/29 13:18:53
high_res_timestamp: 2024-05-29T13:18:53.004+03:00
dg_hier_level_1: 0
dg_hier_level_2: 0
dg_hier_level_3: 0
dg_hier_level_4: 0
vsys_name:
device_name: xxxxxxxxx
vsys_id: 0
vsys:
eventid: general
object:
fmt: 0
id: 0
module: general
severity: high
opaque: Number of hints on disk has exceeded 5000 due to log forward failures.
dg_id: 0
tpl_id: 0

Regards

Kostas Vagenas

Re: SYSTEM ALERT : high : Number of hints on disk has exceeded 5000 due to log forward failures

BPry — Wed, 29 May 2024 21:54:02 GMT

@kvagenas,

Have you verified that you don't actually have any log forwarding enabled that is failing, this isn't limited to Panorama. If you utilize any sort of log forwarding to something like a SYSLOG location, email, Slack, etc. this same alert can trigger if it's unable to actually forward the logs.

Re: SYSTEM ALERT : high : Number of hints on disk has exceeded 5000 due to log forward failures

kvagenas — Thu, 30 May 2024 06:07:01 GMT

I have log forwarding and it is working as it should be. The problem is that after the 1.1.6-h7 update those alerts appeared which do not cause any problem but they are very annoying because they are too many of them.

Re: SYSTEM ALERT : high : Number of hints on disk has exceeded 5000 due to log forward failures

jtfinley72 — Fri, 08 Nov 2024 13:43:04 GMT

I too have the issue. Problem is, it's a default profile w/ Panorama enabled. Since it's readonly, cannot be disabled or deleted.