Hello
I am not sure that we are supposed to be increasing the default size of the FWs.
The customer should make a decision to purchase either a Azure-based Panorama (for collecting the logs), implement a Cortex Data Lake (for collecting logs and machine learning analysis), or consider what logs need to be tracked.
30% of the hard drive is partitioned for Traffic logs.
16% of the hardware is partitioned for Threat Logs
4% for Configuration Logs
4% for System logs.
MUST ALL traffic from the be logged? Example of traffic that would not needed to be (web-browsing, dns, ssl), as these are applications that log quickly, filling up the hardware drive. With proper planning, perhaps a balance could be determined to see IF there is a need to change the % of the partitions around.
From the gui of the FW, the person should go to the Device Log --> Setup --> Logging and Reporting (it is the 3rd tile DOWN within setup).... Modify this section,which by default does not have any days for logs to last, as shown in my example below
After the commit, one should (1x/week) ssh into the FW to issue this command
> show system logdb-quota
The output (in about 30 secs or less) will tell you what percentage you have configured for traffic, and it also tell you how much you have used to date.
Quotas: system: 0.75%, 0.032 GB Expiration-period: 30 days config: 0.75%, 0.032 GB Expiration-period: 30 days alarm: 0.75%, 0.032 GB Expiration-period: 30 days appstat: 0.75%, 0.032 GB Expiration-period: 30 days hip-reports: 0.75%, 0.032 GB Expiration-period: 30 days traffic: 48.39%, 2.056 GB Expiration-period: 180 days threat: 25.00%, 1.062 GB Expiration-period: 180 days
Disk usage: traffic: Logs and Indexes: 2.1G Current Retention: 96 days threat: Logs and Indexes: 1.1G Current Retention: 48 days system: Logs and Indexes: 32M Current Retention: 4 days config: Logs and Indexes: 33M Current Retention: 12 days
... View more
