The OS and applications as well as space for local logging and staging upgrades, patches, backups, restores will require a core amount of space. The 60% value is the algorithm used and may make sense when the disk space is 600GB, but it is certainly fair to question whether this algorithm makes sense for a 1.2TB 2595 or VM with up to 2TB allocation. Originally, the entire backup was copied locally before offloaded which accounted for the much smaller file space allocation to logging, but since that has been enhanced, the amount of disk required for the core files plus reserve for local and debug logging and workspace should not require the full 40% allocation (240GB for 600GB versus 800GB for 2TB disk).
Changes to current logic would entail and enhancement so recommend work with Cisco account team to submit enhancement to allow better control over disk allocation, especially for the larger disk sizes. You can also enter this info via the Feedback button in ISE admin interface. The Product Management team does review these submissions.
Fortunately, there were many enhancements in ISE 2.4 logging which should allow a significant increase in data retention such as the optimization of database tables and removal of very detailed auth log info (the blob seen when click on Live Log details) after 7 days.
Craig
