XDR Agent Quota Exceeded

[T.Kepinski]

Hello, 

We receive numerous alerts of "XDR agent quota exceeded on ****"

I understand this means that the default storage is being exceeded but what exactly does that entail?

1. Are the old logs not being overwritten in time causing the alert to set off since the space has been exceeded? is it actually going over the default space or is there a hard stop where logs wont be collected?

2. Does cortex generate this alert any time an old log is overwritten?

3. Is there anyway to stop these alerts from happening without increasing the storage space?

[mavega]

Hi,

Thanks reaching out LV.

This message usually refers to the agent quota setting that is defined in the agent settings profile, being the default disk space allocated for agent logs is 5000MB, you can increase it up to 10,000 by creating a new agent settings profile. 

Older logs will be overwritten but not all them at the same time.

If you feel this resolved your doubt, please mark is as solution.

[T.Kepinski]

We have deleted the old logs out of the system but we are still receiving the alerts. Is there a way to fix the "agent quota exceeded" without increasing the disk space?