Helpful ReplyHot!FortiAnalyzer VM Growing Disk Space

Author
Travis
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2013/04/11 05:27:10
  • Location: Aurora, Ohio
  • Status: offline
2015/02/04 08:02:34 (permalink)
0

FortiAnalyzer VM Growing Disk Space

I was running out of disk space on my FortiAnalyzer VM, so my VM Admin doubled up the space.  I did a reboot and it did not see the increase, so I upgraded it to 5.0.10, and it still does not see the increase in space.  
 
What do I need to do for it to recognize the expanded disk space?
 
Thank all of you for any assistance!
 
Travis
#1
Dave Hall
Expert Member
  • Total Posts : 1254
  • Scores: 118
  • Reward points: 0
  • Joined: 2012/05/11 07:55:58
  • Location: Canada
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2015/02/04 08:20:52 (permalink)
5 (1)

NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
#2
FortiAdam
Silver Member
  • Total Posts : 103
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/04/21 07:32:57
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2015/02/04 08:21:26 (permalink) ☄ Helpfulby Travis 2015/02/04 09:04:41
5 (1)
Based on my experience with Fortinet support, you will need to reformat your disk for the FAZ to recognize the new space.  
 
It would be better to just add a second disk to your FAZ and then you can "extend" your disk space which basically just means the FAZ sees the two disks as one.  It would appear as though you can do this with up to 8 disks total.
 
If you have to format the disk you can so by running "execute format disk" but be aware of the repercussions.
 
If you want to extend your storage into a second disk:
1.  Verify LVM is started - "execute LVM start"
2.  See if second disk is recognized - "execute lvm info"
3.  Extend storage - "execute lvm extend diskXX"
4.  Rebuild DB after reboot "execute sql-local rebuild-db"
#3
Travis
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2013/04/11 05:27:10
  • Location: Aurora, Ohio
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2015/02/04 09:06:08 (permalink)
0
Thank you both!
 
The link and for the steps.
 
I looked in KB for an answer but did not find that document..
 
Expansion has been completed and my Boss will be happy.
 
Travis
 
#4
Yanis_Sauve
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/02/23 08:34:21
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2015/02/23 08:36:38 (permalink)
0
Could you share your solution?
Posting it here could help someone else in the future...
 
Thanks
#5
FortiAdam
Silver Member
  • Total Posts : 103
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/04/21 07:32:57
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2015/02/23 12:22:09 (permalink)
0
Yanis_Sauve
Could you share your solution?
Posting it here could help someone else in the future...
 
Thanks




There were two solutions posted above which I believe the OP used to fix his issue.  Is there something more specific you are looking for?
#6
Yanis_Sauve
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/02/23 08:34:21
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2015/02/23 12:25:11 (permalink)
0
Not really...
 
His post appeared to say he did not find a solution in the KB, and simply said the job was done.
 
I personnaly used the KB article to add a disk to my FAZ-VM...
 
I only wanted to suggest he posts his solution for the benefit of others. I probably did not fully understand the meaning of his post. :)
#7
bhwong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/03/30 18:57:09
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/20 03:30:00 (permalink)
0
Instead of adding a new disk, I increase the capacity of the existing disk. Is it possible to extend the existing disk capacity in FAZ?
#8
brazz_FTNT
Bronze Member
  • Total Posts : 41
  • Scores: 10
  • Reward points: 0
  • Joined: 2018/02/20 15:09:34
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/21 07:49:03 (permalink) ☄ Helpfulby bhwong 2018/09/23 19:02:55
0
bhwong
Instead of adding a new disk, I increase the capacity of the existing disk. Is it possible to extend the existing disk capacity in FAZ?

 
+++++++++++++++++++++++++++++++++++++
Hello bhwong,
 
You need to format your disk , 
 
check  execute lvm info  on your FAZ 
if you increase the current disk,  the FMG/FAZ VM says the extra space cannot be used unless  format performs. 
 
I would suggest you go over these carefully:

VM Installation Guide
 
Extending disk space in FortiAnalyzer VM / FortiManager VM
#9
bhwong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/03/30 18:57:09
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/23 19:02:39 (permalink)
0
Thanks! After I expand the disk and realise that the recommended method is to add new disk instead of expanding existing disk, I have to edit the vmx file to shrink the disk back to it's original size, as the vSphere web client only allow me to expand but not shrink, despite I have not expand the capacity in the OS yet.
 
I have proceed with adding a new disk of 170GB to my existing 30GB disk (with 8GB as the OS and boot disk). However, I'm surprise that after LVM combine the two disks (30GB + 170GB), the total capacity shown is 150GB instead of 200GB. Why is this so?
 
If I want to maximise my licensed 200GB, should I add another disk with 50GB capacity? Or I have to take the 1/4 lost of capacity in LVM into account by adding a 67GB disk instead, in order to achieve 200GB total capacity?
post edited by bhwong - 2018/09/23 19:06:01
#10
brazz_FTNT
Bronze Member
  • Total Posts : 41
  • Scores: 10
  • Reward points: 0
  • Joined: 2018/02/20 15:09:34
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/24 12:51:48 (permalink)
0
Hello bhwong, 
 
If you do not mind, I would like to see the result of below commands first :
  • get system status
  • get system performance
  • diagnose log device
  • diagnose hardware info
  • execute lvm info
Thanks 
#11
bhwong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/03/30 18:57:09
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/24 18:48:59 (permalink)
0
Sure:
 

FortiAnalyzer-VM # get system status
Platform Type : FAZVM64
Platform Full Name : FortiAnalyzer-VM64
Version : v6.0.2-build0205 180813 (GA)
Serial Number : FAZ-VM0000016459
BIOS version : 04000002
Hostname : FortiAnalyzer-VM
Max Number of Admin Domains : 10000
Admin Domain Configuration : Disabled
Branch Point : 0205
Release Version Information : GA
Current Time : Tue Sep 25 09:41:57 MYT 2018
Daylight Time Saving : Yes
Time Zone : (GMT+8:00) Kuala Lumpur, Singapore.
x86-64 Applications : Yes
Disk Usage : Free 160.57GB, Total 196.73GB
File System : Ext4
License Status : Valid
FortiAnalyzer-VM # get system performance
CPU:
Used: 3.72%
Used(Excluded NICE): 3.72%
%used %user %nice %sys %idle %iowait %irq %softirq
CPU0 5.75 4.93 0.00 0.41 94.25 0.21 0.00 0.21
CPU1 2.47 1.65 0.00 0.62 97.53 0.21 0.00 0.00
Memory:
Total: 6,133,980 KB
Used: 3,158,976 KB 51.5%
Hard Disk:
Total: 206,285,496 KB
Used: 27,413,948 KB 13.3%
IOStat: tps r_tps w_tps r_kB/s w_kB/s queue wait_ms svc_ms %util sampling_sec
5.4 0.6 4.9 35.0 268.0 0.0 7.7 1.1 0.2 319149.21
Flash Disk:
Total: 499,656 KB
Used: 112,644 KB 22.5%
IOStat: tps r_tps w_tps r_kB/s w_kB/s queue wait_ms svc_ms %util sampling_sec
0.0 0.0 0.0 0.0 0.0 0.0 8.2 2.2 0.0 319149.31
FortiAnalyzer-VM # diagnose log device
Device Name Device ID Used Space(logs / quarantine / content / IPS) Allocated Space Used%
AQBAL_FG60D FGT60D4614031499 104.2MB( 104.2MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
AQJC_FG100D FG100D3G15815482 419.3MB( 419.3MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
AQLAV_FG80C FGT80C3913622196 193.4MB( 193.4MB/ 0.0KB/ 0.0KB/ 0.0KB) 1000.0MB 19.3%
AQLI_80E FGT80E4Q17001413 1.0MB( 1.0MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
AQPL_FG100D FG100D3G14815673 1.0MB( 1.0MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
AqJB FG100D3G13814478 143.3MB( 143.3MB/ 0.0KB/ 0.0KB/ 0.0KB) 1000.0MB 14.3%
DC_FG110D FGHA000907780240_CID 542.0MB( 542.0MB/ 0.0KB/ 0.0KB/ 0.0KB) 1000.0MB 54.2%
|- HA cluster member: FG100D3G16808611
HQ_FG100D FG100D3G16808517 118.6MB( 118.6MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
M1_100E FG100E4Q17021238 1.0MB( 1.0MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
SFP_81E FGT81E4Q17000729 2.0MB( 2.0MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
tacc_FG80C FGT80C3911615643 7.3MB( 7.3MB/ 0.0KB/ 0.0KB/ 0.0KB) 1000.0MB 0.7%
Total: 11 log devices, used=1.5GB quota=3.9GB

AdomName AdomOID Type Logs Database
[Retention Quota UsedSpace(logs / quarantine / content / IPS) Used%] [Retention Quota Used Used%]
root 3 FGT 1936days 60.0GB 1.5GB( 1.5GB/ 0.0KB/ 0.0KB/ 0.0KB) 2.5% 1676days 90.0GB 16.8GB 18.7%
Total usage: 1 ADOMs, logs=1.5GB database=17.5GB(ADOMs usage:16.8GB + Internal Usage:768.7MB)
Total Quota Summary:
Total Quota Allocated Available Allocate%
157.7GB 150.0GB 7.7GB 95.1%
System Storage Summary:
Total Used Available Use%
196.7GB 36.2GB 160.6GB 18.4%
Reserved space: 39.0GB (19.8% of total space).
FortiAnalyzer-VM # diagnose hardware info
### CPU info
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 58
model name : Intel(R) Xeon(R) CPU E5-2680 v2 @ 2.80GHz
stepping : 0
microcode : 0x42c
cpu MHz : 2800.000
cache size : 25600 KB
physical id : 0
siblings : 1
core id : 0
cpu cores : 1
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 13
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts nopl tsc_reliable nonstop_tsc pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 popcnt aes hypervisor lahf_lm arat
bugs : cpu_meltdown spectre_v1 spectre_v2
bogomips : 5600.00
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management:
processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 58
model name : Intel(R) Xeon(R) CPU E5-2680 v2 @ 2.80GHz
stepping : 0
microcode : 0x42c
cpu MHz : 2800.000
cache size : 25600 KB
physical id : 2
siblings : 1
core id : 0
cpu cores : 1
apicid : 2
initial apicid : 2
fpu : yes
fpu_exception : yes
cpuid level : 13
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts nopl tsc_reliable nonstop_tsc pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 popcnt aes hypervisor lahf_lm arat
bugs : cpu_meltdown spectre_v1 spectre_v2
bogomips : 5600.00
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management:

### Memory info
MemTotal: 4057444 kB
MemFree: 188592 kB
MemAvailable: 1737432 kB
Buffers: 87964 kB
Cached: 2310372 kB
SwapCached: 44644 kB
Active: 2202940 kB
Inactive: 946096 kB
Active(anon): 1132820 kB
Inactive(anon): 552836 kB
Active(file): 1070120 kB
Inactive(file): 393260 kB
Unevictable: 444872 kB
Mlocked: 444872 kB
SwapTotal: 2076536 kB
SwapFree: 427832 kB
Dirty: 1008 kB
Writeback: 0 kB
AnonPages: 1154144 kB
Mapped: 913100 kB
Shmem: 934928 kB
Slab: 145972 kB
SReclaimable: 115196 kB
SUnreclaim: 30776 kB
KernelStack: 5888 kB
PageTables: 95784 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 4105256 kB
Committed_AS: 21222260 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 0 kB
VmallocChunk: 0 kB
DirectMap4k: 12224 kB
DirectMap2M: 4182016 kB
### Disk info
major minor #blocks name
1 0 4096 ram0
1 1 4096 ram1
1 2 4096 ram2
1 3 4096 ram3
7 0 10240 loop0
8 0 8388608 sda
8 1 524288 sda1
8 16 31457280 sdb
8 17 31455238 sdb1
8 32 178257920 sdc
253 0 209707008 dm-0
### RAID info
N/A
### System time
local time: Tue Sep 25 09:41:22 2018
UTC time: Tue Sep 25 01:41:22 2018
FortiAnalyzer-VM # execute lvm info
LVM Status: OK
Disk1 : Used 31GB
Disk2 : Used 178GB
Disk3 : Unavailable 0GB
Disk4 : Unavailable 0GB
Disk5 : Unavailable 0GB
Disk6 : Unavailable 0GB
Disk7 : Unavailable 0GB
Disk8 : Unavailable 0GB
Disk9 : Unavailable 0GB
Disk10 : Unavailable 0GB
Disk11 : Unavailable 0GB
Disk12 : Unavailable 0GB
Disk13 : Unavailable 0GB
Disk14 : Unavailable 0GB
Disk15 : Unavailable 0GB
#12
brazz_FTNT
Bronze Member
  • Total Posts : 41
  • Scores: 10
  • Reward points: 0
  • Joined: 2018/02/20 15:09:34
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/26 12:35:01 (permalink) ☄ Helpfulby bhwong 2018/09/26 20:20:56
0
Hello bhwong, 
 
Thanks for the outputs. 
 
As you can see based  on the provided results:



I)FortiAnalyzer-VM # execute lvm info
Disk1 : Used 31GB
Disk2 : Used 178GB
209GB
 

II)FortiAnalyzer-VM # get system status
Disk Usage : ... Total 196.73GB
III)FortiAnalyzer-VM # get system performance
Hard Disk:
Total: 206,285,496 KB --->206,285,496/(1024*1024)GB--->196.7291794GB~196.73GB

IV)FortiAnalyzer-VM # diagnose log device
Total Quota Summary:
Total Quota Allocated Available Allocate%
157.7GB 150.0GB 7.7GB 95.1%
System Storage Summary:
Total Used Available Use%
196.7GB 36.2GB 160.6GB 18.4%
Reserved space: 39.0GB (19.8% of total space).
 
 
Total Quota(This  is the one we use for our logs)=Total Storage Summary - Reserved Space =196.7GB-39.0GB=157.7GB


We have couple of points here:
(I) is showing the entire physical disk size. 
(II) , (III) , and (IV) (Total Storage) are showing same number. 
(IV) also shows us the Total Quota which is the one we can use for logging purposes. 
 
We can try adding another disk to this VM , let's say  for example another 50 GB for now. 
Let me know about the results. 
 
Cheers
#13
bhwong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/03/30 18:57:09
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/26 20:26:20 (permalink)
0
I always assume the first 8GB disk was for the system usage, not the 30+GB that is for data storage. I have added another 50GB and got 196GB now, slightly lesser than expected.
 


At the Device Log Settings, there is also a Roll log file when size exceeds 200MB. Should this be increased since there is 200GB available now? Or the main storage consumption isn't used by the logs but the analyser output?

Attached Image(s)

#14
brazz_FTNT
Bronze Member
  • Total Posts : 41
  • Scores: 10
  • Reward points: 0
  • Joined: 2018/02/20 15:09:34
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/27 13:33:32 (permalink)
0
Hello bhwong,
 
Thanks for the update. 
 
 

I always assume the first 8GB disk was for the system usage, not the 30+GB that is for data storage. 
 

 
Yes, actually ,  that is the case .
 
 
The FortiAnalyzer VM requires at least two virtual hard disks. Before powering on the
FortiAnalyzer VM, you must add at least one more virtual hard disk. The default hard drive,
faz.vhd, contains the operating system. The second hard drive is used for logs.
 
Please check ((To configure the virtual hard disk--->P{21})) for more info.
 
 
Can I see the results of below now ?
 
  • get system status
  • get system performance
  • diagnose log device
  • execute lvm info
 
 
 
 

 At the Device Log Settings, there is also a Roll log file when size exceeds 200MB. Should this be increased since there is 200GB available now? Or the main storage consumption isn't used by the logs but the analyser output?



This is depends on what you are looking for. If you set it to lower size it will roll the log file in smaller size . I would say let's keep it as default for now.
 
For more details on this I would encourage you to review this ((Roll logs when they reach a specific size--->P{188})).
 
Thanks  
 
#15
bhwong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/03/30 18:57:09
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/27 19:11:51 (permalink)
0
Thanks for the manuals. Unfortunately I don't have the luxury of time to read thru them in details.
 
btw, I have only enable one network port. What is the purpose for having 4 network ports? 
 
Attached is the output requested.
 
#16
brazz_FTNT
Bronze Member
  • Total Posts : 41
  • Scores: 10
  • Reward points: 0
  • Joined: 2018/02/20 15:09:34
  • Status: offline
Re: FortiAnalyzer VM Growing Disk Space 2018/09/28 07:59:20 (permalink)
0
Hello bhwing, 
Thanks for your reply.
 

btw, I have only enable one network port. What is the purpose for having 4 network ports? 

It is actually depends on your network design, let's say you would like to have a dedicated management IP to your FAZ then you may configure another port on FortiAnalyzer as the logging interface. In that case,  you need to  assign specific IPv4 or IPv6 static routes to a different gateway, so that packets are delivered by a different route. 
 
 
Also please make sure the extra space has been allocated to the ADOM. 
Go to System Setting --->All ADOMs---> Select root--->edit--->Check the Disk Utilization
 
Cheers
 
 
 
#17
Jump to:
© 2018 APG vNext Commercial Version 5.5