Palo Alto Networks Knowledgebase: How to Determine How Much Disk Space is Allocated to Logs

How to Determine How Much Disk Space is Allocated to Logs

26845
Created On 08/05/19 20:22 PM - Last Updated 08/05/19 20:36 PM
Resolution

To view how much space is used by logs:

  • Run the following command via CLI: show system disk-space


The output would seem as below

> show system disk-space

Filesystem            Size    Used   Avail Use% Mounted on

/dev/sda3             3.8G    1.1G    2.5G  31% /

/dev/sda5             7.6G    2.1G    5.1G  29% /opt/pancfg

/dev/sda6             3.8G    2.7G    932M  75% /opt/panrepo

tmpfs                   487M   37M     451M   8% /dev/shm

/dev/sda8             125G   403M    118G   1% /opt/panlogs

The line ending with with the panlogs tells you how much is allocated to logs.

Logs are purged when the quota is exceeded, so it is recommended not to allocate more than 95% of the space to allow some buffer space.

Disk quota for the different log types can be viewed from CLI or the GUI in Device > Setup > Logging and Reporting Settings

9-19-2012 11-25-14 AM.png

> show system logdb-quota

Quotas:

             traffic: 32.00%, 38.123 GB

              threat: 16.00%, 19.061 GB

              system: 4.00%, 4.765 GB

              config: 4.00%, 4.765 GB

               alarm: 3.00%, 3.574 GB

               trsum: 7.00%, 8.339 GB

         hourlytrsum: 3.00%, 3.574 GB

          dailytrsum: 1.00%, 1.191 GB

         weeklytrsum: 1.00%, 1.191 GB

               thsum: 2.00%, 2.383 GB

         hourlythsum: 1.00%, 1.191 GB

          dailythsum: 1.00%, 1.191 GB

         weeklythsum: 1.00%, 1.191 GB

             appstat: 6.00%, 7.148 GB

              userid: 1.00%, 1.191 GB

            hipmatch: 3.00%, 3.574 GB

   application-pcaps: 1.00%, 1.191 GB

        threat-pcaps: 1.00%, 1.191 GB

  debug-filter-pcaps: 1.00%, 1.191 GB

         hip-reports: 1.00%, 1.191 GB

            dlp-logs: 1.00%, 1.191 GB

Disk usage:

traffic: Logs: 53M, Index: 78M

threat: Logs: 8.1M, Index: 340K

system: Logs: 18M, Index: 2.1M

config: Logs: 29M, Index: 244K

alarm: Logs: 16K, Index: 16K

trsum: Logs: 25M, Index: 720K

hourlytrsum: Logs: 508K, Index: 576K

dailytrsum: Logs: 396K, Index: 620K

weeklytrsum: Logs: 72K, Index: 196K

thsum: Logs: 276K, Index: 276K

hourlythsum: Logs: 264K, Index: 264K

dailythsum: Logs: 256K, Index: 256K

weeklythsum: Logs: 40K, Index: 40K

appstatdb: Logs: 448K, Index: 696K

userid: Logs: 56K, Index: 24K

hipmatch: Logs: 16K, Index: 16K

application-pcaps: 156K

threat-pcaps: 4.0K

debug-filter-pcaps: 4.0K

dlp-logs: 4.0K

hip-reports: 1.1M

wildfire: 4.0K

owner: mbutt



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgZCAS&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language