XDR agent quota exceeded

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

XDR agent quota exceeded

L1 Bithead

We were monitoring the XDR Agent Audit logs and found out a lot of agents have this alert Quota Exceeded: "XDR agent quota exceeded on ******."

Can anyone explain this? 

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @MahmudHKamol, thank you for reaching out to Live Community.

This message usually refers to the agent quota setting that is defined in the agent settings profile. The default disk space allocated for agent logs is 5000MB, you can increase it up to 10,000 by creating a new agent settings profile.

If the problem persists I would advise opening a support ticket through our customer support portal.


Hope this helps!

Visit our Cortex XDR Customer Corner on Live Community to access resources for your product journey, engage in discussions with community members and subject matter experts, and register for upcoming events: Cortex XDR Customer Corner

View solution in original post

3 REPLIES 3

L4 Transporter

Hi @MahmudHKamol, thank you for reaching out to Live Community.

This message usually refers to the agent quota setting that is defined in the agent settings profile. The default disk space allocated for agent logs is 5000MB, you can increase it up to 10,000 by creating a new agent settings profile.

If the problem persists I would advise opening a support ticket through our customer support portal.


Hope this helps!

Visit our Cortex XDR Customer Corner on Live Community to access resources for your product journey, engage in discussions with community members and subject matter experts, and register for upcoming events: Cortex XDR Customer Corner

Hi @mavraham, thanks for the explanation. What happens when an agent log reaches the allocated space (5000 MB)? Does it overwrites the old logs? or it deletes it's whole log and starts from fresh?

L4 Transporter

Hi @MahmudHKamol,

You are correct. It will overwrite old logs, not all of them at once.


Visit our Cortex XDR Customer Corner on Live Community to access resources for your product journey, engage in discussions with community members and subject matter experts, and register for upcoming events: Cortex XDR Customer Corner

  • 1 accepted solution
  • 2435 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!