High log DB usage for Palo Alto Networks


Palo Alto Networks


Indeni will alert if the log DB utilization of a device is above a high threshold.

Remediation Steps

More information is available at https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Determine-How-Much-Disk-Space-is-Allocated-to-Logs/ta-p/53828

How does this work?

This alert uses the Palo Alto Networks API to retrieve the current status of the log DBs (the equivalent of running "show system logdb-quota" in CLI).

Why is this important?

The log DB stores a variety of different log types on a Palo Alto Networks device. Most log databases will auto-purge older logs. In many environments, though, such behavior is not desired. Users should know if they are reaching the maximum amount of logs they can retain of a certain type and assess the possible impact.

Without Indeni how would you find this?

An administrator could write a script to leverage the Palo Alto Networks API to collect this data periodically and alert appropriately. The web interface can also be used to check the current status of the log DB utilization.

View Source Code