topic Re: Forensics logs filling up the log partition in Cloud Firewall

Forensics logs filling up the log partition

Ryan_Ryan — Tue, 28 Jun 2022 23:31:57 GMT

Hi we have cloudguard firewalls (R80.10) that are constantly filing their log partition to 100% due to the 'forensics' track option being enabled under the TP policy.

(files are in /var/log/opt/CPsuite-R80/fw1/log/forensics and all have *.cap extension)

Rather than just turn this off, is there a way to start rolling the files once disk space exceeds 90% or so? or even better can we have the cap files stored on the log server rather than the gateway?

Re: Forensics logs filling up the log partition

Timothy_Hall — Wed, 29 Jun 2022 11:29:47 GMT

Known issue in your EOL version: sk165914: IPS Forensic logs (packet capture) are not being deleted

Re: Forensics logs filling up the log partition

Ryan_Ryan — Wed, 29 Jun 2022 21:49:33 GMT

Thanks Timothy good to know (unfortunately R80.10 is the latest version we can run on nsx-v)