Acknowledge Traffic Log Threshold Alarms

[herrmoss]

We recently reached the point where our traffic logs are reaching 90% of quota and alarms are being generated.  I understand that this behavior is normal and I do have the option of turning alarms off if I wish.  I don't want to turn them off but I see the option to acknowledge them.  What I'm wondering is do these acknowledgements ever get purged?  Because it looks like as long as keep acknowledging them they will just be moved to the acknowledged window.

[gwesson · Accepted solution]

Every log eventually gets purged, based on the quota set. You can check it with:

> show system logdb-quota

It'll give you a list of all the log quotas, including Alarm logs. You can also adjust these values if needed, reducing the total for alarms and putting that into something else if you like. 

[herrmoss]

Thanks for the reply.

Using that command I don't see Alarm logs called out separately, are they lumped in with one of the other logs I see listed there?

[DarinSutton]

In the GUI under Device--Log Settings

you can choose what the % is before you get an alarm - for each log separately

under MANAGE Alarms - you can clear the ALARM logs ONLY if desired

[herrmoss]

Upon further review I see that Alarm logs are called out separately.  Apologies for my earlier confusion.

[yarinbenado]

Not exactly what you've asked for but you may consider taking a look at indeni and disabling these alarms. indeni is already aware of the 90% threshold so will only alert if you hit 91% (which, oddly enough, does happen sometimes).