topic Re: Acknowledge Traffic Log Threshold Alarms in General Topics

Acknowledge Traffic Log Threshold Alarms

herrmoss — Fri, 16 Oct 2015 19:16:36 GMT

We recently reached the point where our traffic logs are reaching 90% of quota and alarms are being generated. I understand that this behavior is normal and I do have the option of turning alarms off if I wish. I don't want to turn them off but I see the option to acknowledge them. What I'm wondering is do these acknowledgements ever get purged? Because it looks like as long as keep acknowledging them they will just be moved to the acknowledged window.

Re: Acknowledge Traffic Log Threshold Alarms

gwesson — Fri, 16 Oct 2015 20:03:53 GMT

Every log eventually gets purged, based on the quota set. You can check it with:

> show system logdb-quota

It'll give you a list of all the log quotas, including Alarm logs. You can also adjust these values if needed, reducing the total for alarms and putting that into something else if you like.

Re: Acknowledge Traffic Log Threshold Alarms

herrmoss — Wed, 21 Oct 2015 17:29:09 GMT

Thanks for the reply.

Using that command I don't see Alarm logs called out separately, are they lumped in with one of the other logs I see listed there?

Re: Acknowledge Traffic Log Threshold Alarms

DarinSutton — Wed, 21 Oct 2015 17:36:32 GMT

In the GUI under Device--Log Settings

you can choose what the % is before you get an alarm - for each log separately

under MANAGE Alarms - you can clear the ALARM logs ONLY if desired

Re: Acknowledge Traffic Log Threshold Alarms

herrmoss — Thu, 22 Oct 2015 13:38:22 GMT

Upon further review I see that Alarm logs are called out separately. Apologies for my earlier confusion.

Re: Acknowledge Traffic Log Threshold Alarms

yarinbenado — Thu, 29 Oct 2015 15:07:36 GMT

Not exactly what you've asked for but you may consider taking a look at indeni and disabling these alarms. indeni is already aware of the 90% threshold so will only alert if you hit 91% (which, oddly enough, does happen sometimes).