topic Daily log ingestion in General Topics

Daily log ingestion

RemoteUser — Wed, 27 Aug 2025 10:22:49 GMT

Am i the only one?
I see that start to happening in other customer as well.

Re: Daily log ingestion

_Val_ — Wed, 27 Aug 2025 10:26:59 GMT

Are you over the quota?

Re: Daily log ingestion

the_rock — Wed, 27 Aug 2025 10:31:21 GMT

You need license for bigger quota.

Re: Daily log ingestion

RemoteUser — Wed, 27 Aug 2025 10:46:47 GMT

got it thanks

Re: Daily log ingestion

PhoneBoy — Wed, 27 Aug 2025 18:24:58 GMT

Depending on the exact service and SKUs you've purchased, there are limits to the amount of logs that can be ingested.
We only started enforcing this earlier this year which is why you are seeing the message now.
This either requires reducing the log volume or purchasing the appropriate SKU to update the limits.

Re: Daily log ingestion

Tomer_Noy — Thu, 28 Aug 2025 07:00:31 GMT

Indeed, your daily log ingestion is exceeding your quota.

You can get more information about your quota and ingestion patterns in the Log Ingestion Dashboard of the Infinity Events application.
Here's a screenshot from a demo tenant:

You can see your ingestion over time, and split by applications (if you have more than one).

You can also leverage Infinity Events to identify "noisy" rules that generate a lot of logs, then switch them to "Session Logs" or deactivate logging on them (if appropriate).

These SKs have lots of useful information on this:
https://support.checkpoint.com/results/sk/sk182394
https://support.checkpoint.com/results/sk/sk181096

Re: Daily log ingestion

RemoteUser — Thu, 28 Aug 2025 08:02:10 GMT

thank you so much for the explanation, very satisfying!

Re: Daily log ingestion

RemoteUser — Thu, 28 Aug 2025 08:02:40 GMT

thanks you @PhoneBoy

Re: Daily log ingestion

the_rock — Thu, 28 Aug 2025 12:04:41 GMT

Thats great place to check, indeed.