Daily log ingestion

[RemoteUser]

Am i the only one?
I see that start to happening in other customer as well.

[_Val_]

Are you over the quota?

[the_rock]

You need license for bigger quota.

[RemoteUser]

got it thanks

[PhoneBoy]

Depending on the exact service and SKUs you've purchased, there are limits to the amount of logs that can be ingested.
We only started enforcing this earlier this year which is why you are seeing the message now.
This either requires reducing the log volume or purchasing the appropriate SKU to update the limits.

[RemoteUser]

thanks you @PhoneBoy 

[Tomer_Noy · Accepted solution]

Indeed, your daily log ingestion is exceeding your quota.

You can get more information about your quota and ingestion patterns in the Log Ingestion Dashboard of the Infinity Events application.
Here's a screenshot from a demo tenant:

You can see your ingestion over time, and split by applications (if you have more than one).

You can also leverage Infinity Events to identify "noisy" rules that generate a lot of logs, then switch them to "Session Logs" or deactivate logging on them (if appropriate).

These SKs have lots of useful information on this:
https://support.checkpoint.com/results/sk/sk182394 
https://support.checkpoint.com/results/sk/sk181096 

[RemoteUser]

thank you so much for the explanation, very satisfying!

[the_rock]

Thats great place to check, indeed.