By default, what happens when a log file reaches its maximum file size?

By default, when an active log file for a specific device reaches its configured maximum size, FortiAnalyzer performs a process called "log rolling". This involves closing the current active log file, renaming it to an archive file (typically by adding a numerical suffix and compressing it), and then creating a new, empty active log file to receive subsequent logs. This ensures continuous logging without data loss and organizes logs into manageable, archived chunks.

A. FortiAnalyzer overwrites the log files: This action, "Overwrite Oldest Log," is triggered when the total allocated disk space for logs is full, not when an individual log file reaches its size limit.

B. FortiAnalyzer stops logging: FortiAnalyzer is designed for continuous monitoring and does not stop logging as a standard procedure; this would be a critical failure, not a log management feature.

D. FortiAnalyzer forwards logs to syslog: Log forwarding is a separate, configurable feature for sending logs to an external server and is not the default action for managing local log file size.

1. FortiAnalyzer Administration Guide 7.4.0

Page 101

"Log file management": "When a device log file reaches the size specified in the device's log rolling settings

the FortiAnalyzer rolls the active log file. The log file is renamed to indicate that it is an archive log

and a new

empty log file is created for the device."

2. FortiAnalyzer Administration Guide 7.4.0

Page 102

"Configuring log rolling and scheduled uploads": "You can configure the FortiAnalyzer to roll the log file when it reaches a certain size..." This section details the settings for triggering the roll

confirming it's a size-based mechanism.

3. FortiAnalyzer Administration Guide 7.4.0

Page 100

"Log storage information": This section describes the disk utilization policy

stating

"When the allocated disk space is 85% full

FortiAnalyzer will start overwriting the oldest archive log files." This clearly differentiates the disk quota policy (overwrite) from the file size policy (roll).