WSA S390: Error message

[jds5]

Hello,

We have updated one of our two S390 web proxies from version 12.0.1-334 to version 14.5.0-537.

The update went well but when we connected via CLI to the Appliance, we got this message:

You have exceeded the maximun log space. Please reconfigure it to avoid system crash

Do you want to reconfigure it? [Y]>

After checking, we did not find any trace of disk space problem and by answering N, we got the same message again

We need to perform the same update on our second Appliance.

Can you help us on this point to tell us if this point is blocking or not?

Thank you,

[jds5]

Have any of you ever encountered this type of error?
Thanks in advance for your feedback.

[amojarra]

Hello @jds5 

Thanks for sharing your Experience, 

Kindly check this link please : Resolve Secure Web Appliance Full Disk Error - Cisco

You can see the status of your disk usage from CLI > status detail 

Also, if there are any disk usage issue, you can see them from the output of CLI > displayalerts

Regarding your warning message: You have exceeded the maximum log space. Please reconfigure it to avoid system crash

this error is usually informative to let you know the log's rollover configuration, might lead to disk usage above 100% 

lets say if you have 100GB disk space and configure 2 logs (for example Accesslogs and system_logs ) to keep 100 logs each 1GB, ( total 200GB if they both gets full) above warning message will shown. 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[jds5]

Hi Amirhossein,

Thank you for this information.

In fact, we have exceeded the threshold of 80% disk space usage.

What are the recommendations to have when configuring Access Logs?

Currently, we have:
Rollover by file size is configured at 9G each day

Is this configuration compliant?

BR,

José

[amojarra]

@jds5 

Thanks for your reply

The answer to your question is, really depends on your internal policies, which how long you need to keep the logs 

please allow me to highlight some notes here, 

[1] you will have the history in the reports, as far as they are not overwrite 

[2] you can compress the logs, 

[3] you can also download some older logs via FTP in case you need to archive them

[4] you can always use Syslog server to push the logs there if you need to keep longer duration, 

[5] Log size has direct relation to load on WSA, lets say a busy WSA might generate 1GB logs in 30 minutes, and some not heavy loaded WSA will reach 1GB logs in a day. so it is up your device how long and what size you need to store the logs 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[jds5]

Hello,

Thank you for these precisions.

To close this topic, could you tell me what Cisco's recommendations are in relation to this threshold of 80% for log disk space?
Can exceeding this value cause the proxy to crash?

BR,

José

[amojarra]

José, 

hello 

above 90% you need to take action.and above 80% is best for planing. 

if the disk went to 100% this might lead to some crashes which needs to re-image the device. 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++