WSA | reporting/logging disk 97%

[ccg-security]

Hi Team,

How can we decrease our reporting/logging disk? 

[ondjultomte]

Hade you added a Custom fields to loggs?

If not you need more iops, perhaps add another mirror for raid 10.

Since the WSA is based on FreeBSD one would wish that Cisco would use the buildt in support for ZFS, then we could use lz4 compression on the local logg drives! It would also eliminate the raid card as a failure risc.

[ccg-security]

Hi,

What do you mean by iops? Is there a way to remove via cli or gui to decrease the logs? Can we determine what's causing this high disk?

Thanks!

[ondjultomte]

Are you running a VM or appliance ?

Adding custom fields to the access logs will increase the disc io.

[Handy Putra]

Hi,

Would recommend to enable the "Log Compression" in the logs (GUI -> System Administration -> Log Subscription -> select the logs, for example accesslogs -> tick the Log Compression as enabled.

This would compress each logs in accesslogs therefore lower down the disk usage.

Also check if you have any logs that send out to remote FTP or syslog and check the connectivity to that server has no issue, if there is issue sending off those logs, WSA will stored those logs locally when it failed to sent out those logs out, hence will increase the disk usage.

If you want a break down what is causing the disk usage, would recommend to open Cisco TAC case for the engineer to check it from the remote tunnel access.

Regards

Handy Putra

[Vishnu_RR]

Hi guys,

I just wanted to know what is the total disk space for Reporting/Logging on WSA and SMA.

I am using SMA M395 and WSA S695 physical appliances.

any answers would be appreciated.

[amojarra]

from CLI run command : ipcheck   

note that this is a hidden command and can not be completed with TAB

for SMA you can use this command from CLI :    diskquotaconfig

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[zoeydaisy.91]

• To reduce disk usage instantly, delete all logs for a given log type  (logs can not be deleted according to the date). 
• The following logs can be cleared
  • Traffic logs
  • Threat, URL, and Data Logs
  • Configuration logs
  • System logs
  • HIP Match logs
  • GlobalProtect logs
  • Alarm logs
  • Tunnel, GTP logs
  • User-ID logs
  • IP-Tag logs
  • Authentication logs
  • Decryption logs
  • ACC database (CLI command only)
  • SCTP logs (CLI command only)

[amojarra]

it could be related to old reports in the box, for example reports from couple of years ago.

I recommend you to open a TAC case, we will check the disk usage and will proceed further if the high usage is related to reports or LOGS. 

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++