Guest

Cisco Web Security Appliance

What is the behavior of an WSA when the logging partition runs out of space?

Document ID: 117941

Updated: Jul 15, 2014

Contributed by Jakob Dohrmann and Siddharth Rajpathak, Cisco TAC Engineers.

   Print

Question

What is the behavior of an WSA when the logging partition runs out of space?

Environment

Cisco Web SecurityAppliance (WSA), all versions of AsyncOS

Symptoms

You receive alerts like the ones below:

----------------------------------------------------------------------
The Warning message is:

Processing of collected reporting data has been disabled due to lack of logging disk space. Disk usage is above 97 percent.
Recording of reporting events will soon become limited and reporting data may be lost if disk space is not freed up (by removing old logs, etc).

Once disk usage drops below 97 percent, full processing of reporting data will be restarted automatically.

----------------------------------------------------------------------
The Critical message is:

The log partition is at 107% capacity
----------------------------------------------------------------------

 

Solution

As the alerts indicate, logging and reporting is suspended until you clear up disk space on the Cisco Web Security appliance (WSA). You can do that by deleting logs or by lowering the maximum number of files that should be kept and then doing a 'rollover'.

You can find the relevant settings in the GUI under 'System Administration -> Log Subscriptions'.

If this does not help, please contact Cisco TAC and enable remote access from GUI --> Support & Help --> Remote Access. A Support Engineer will then assist you in resolving the issue.

Updated: Jul 15, 2014
Document ID: 117941