Log Volume Overwhelming the Disk
A FortiGate 100F with a 480 GB SSD is filling its local disk every ~10 days. Logs show the majority is forward-traffic logs from a busy web server VLAN (about 60% of volume), plus UTM logs from an IPS profile set to block+log on all signatures. You need 30 days of retention for security events, cannot add a FortiAnalyzer this quarter, and must not lose IPS/antivirus events. Administrators still need to troubleshoot the web VLAN occasionally.
1. Propose a logging configuration that meets 30-day retention for security events without losing troubleshooting ability.
Read the worked answer
Separate security events from high-volume routine traffic:
- On the web-server policy, set logtraffic to
utm(or disable traffic logging) and keep UTM logging on - you retain IPS/AV events but stop logging every session. - For the occasional troubleshooting need, use on-demand capture (
diagnose sniffer packet) or temporarily enable traffic logging for a scoped policy/duration rather than permanently. - Keep event logs (admin, auth, system) at full logging.
- Set disk log retention/roll to ensure 30 days of the reduced volume; verify with
diagnose log disk usage.
This cuts the dominant 60% volume while preserving 100% of IPS/AV events, which is what the 30-day requirement actually protects.
2. The IPS profile blocks+logs every signature, generating excessive UTM logs. How do you reduce UTM log volume without weakening protection?
Read the worked answer
Keep the action the same but reduce logging noise:
- Set the IPS profile to log only on action (block) rather than logging every match; many signatures are set to
monitor/log-only and flood logs without blocking. - Change low-value, high-noise signatures from log to pass/monitor off only after reviewing - but be careful: the requirement is not to lose IPS events, so prefer keeping block actions and trimming duplicate logging.
- Use rate limiting / dedup on logging where available, and ensure the profile isn't logging both IPS and a redundant app-control entry for the same flow.
Validate by comparing UTM log rate before/after and confirming blocked-attack events still appear. Do not disable the IPS sensor; tune logging granularity instead.