A lot of our small customers are using SMS as log server too. Normally, we set automatic deletion of old logs when disk space falls below 5 or 10 GB (we increase these numbers before upgrades). It generally works everywhere.
However, after providing hcp output to Check Point support, we received recommendation to keep /var/log partition below 70% usage. For this customer, partition size is around 800GB, so it means 240GB would be "on standby", but not really used. For some other customers, unused space would be close to 1TB.
Any reason to require few hundred gigabytes of available space for /var/log? I did not find this recommendation documented anywhere else and I would like to clarify before we inform number of customers about this recommendation.