You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?
You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?
When logging is enabled on a FortiGate device and configured to use the local disk, the default behavior when the disk becomes full is that logs are overwritten. The first warning is issued when log disk usage reaches the threshold of 75%. This ensures continuous logging without interruption, as the system overwrites old logs to make space for new ones while providing an early warning when the disk space is extensively used.
It's D. Fortigate reserves 25% of disk
https://docs.fortinet.com/document/fortigate/6.4.0/cli-reference/462620/log-disk-setting Log full first warning threshold as a percent (1 - 98, default = 75).