Question
What is the behavior of an WSA when the logging partition runs out of space?
Environment
Cisco Web SecurityAppliance (WSA), all versions of AsyncOS
Symptoms
You receive alerts like the ones below:
----------------------------------------------------------------------
The Warning message is:
Processing of collected reporting data has been disabled due to lack of logging disk space. Disk usage is above 97 percent.
Recording of reporting events will soon become limited and reporting data may be lost if disk space is not freed up (by removing old logs, etc).
Once disk usage drops below 97 percent, full processing of reporting data will be restarted automatically.
----------------------------------------------------------------------
The Critical message is:
The log partition is at 107% capacity
----------------------------------------------------------------------
Solution
As the alerts indicate, logging and reporting is suspended until you clear up disk space on the Cisco Web Security appliance (WSA). You can do that by deleting logs or by lowering the maximum number of files that should be kept and then doing a 'rollover'.
You can find the relevant settings in the GUI under 'System Administration -> Log Subscriptions'.
If this does not help, please contact Cisco TAC and enable remote access from GUI --> Support & Help --> Remote Access. A Support Engineer will then assist you in resolving the issue.
Feedback