traffic log database exceeds alarm threshold value 100% of total allowed size

[Zorgnet]

Hello community,

On my paloalto 850 I get several alarms every day stating:

"Current suz (xxxMB) of traffic log database exceeds alarm threshold value (100%) of total allowed size (xxxMB).

On the CLI a "show system disk-space" shows the disk on not full:

Filesystem Size Used Avail Use% Mounted on
/dev/root         9.5G    3.4G    5.6G  38% /
none              2.5G    68K     2.5G     1% /dev
/dev/sda5      19G    5.6G     13G    31% /opt/pancfg
/dev/sda6       7.6G    3.6G    3.7G  50% /opt/panrepo
tmpfs              2.5G    361M   2.2G 15% /dev/shm
cgroup_root   2.5G    0           2.5G   0% /cgroup
/dev/sda8      173G    141G    24G  86% /opt/panlogs

How could I solve this?

Pan-os 10.1.10-h2

Jan

[kiwi]

Hi @Zorgnet ,

Disk-space is not the same as the threshold value you have set on the different log databases.

The device will start overwriting the oldest logs automatically once you reach the quota.  So the drive will always be around the quota size as the logs will roll round.

The device will be writing logs to the drive even if you have a log forwarding profile set up but you can always export the logs and then delete them from the device to clear some space.

Logging at session end is a good way of cutting down on logs generated (instead of logging at session start and end).

Execute the below CLI command to view your quotas.

> show system logdb-quota 

Please refer to the below links to know to more about this exact behavior and how to eliminate alarm message:

Alarm "Current size of traffic log database exceeds alarm threshold value of total allowed size"

How to Eliminate Alarm Message: Log Database Exceeds Alarm Threshold Value

Kind regards,

-Kim.