Data management

Hi Markus Hosch ,

Although the section title says Log retention report data, the section sets the limits only for reports. Our apology for the confusion it's caused. We've updated the help page to clarify this: https://docs.sophos.com/nsg/sophos-firewall/Latest/Help/en-us/webhelp/onlinehelp/index.html?contextId=reports-settings-data-management. 

The available disk space for event logs and reports is as follows:

Event logs: These are the logs shown in the Log viewer. They can take up to 15 percent of the /var space or 50 percent of the /var space - whichever is lower. See https://docs.sophos.com/nsg/sophos-firewall/Latest/Help/en-us/webhelp/onlinehelp/index.html?contextId=logs

Reports: When reports cross 80 percent of the /var space, additional reports aren't generated until the space they take up is brought down to less than 70 percent /var space. In both instances (when they cross 70 and 80 percent), an alert appears on the Control center in the Messages section. These figures apply to the latest SFOS version.

When reports are deleted (Reports > Manual purge), logs remain intact. Similarly, when logs are purged (console > system diagnostics purge-all-logs), reports remain intact.

Unfortunately, the firewall doesn't allow you to selectively delete each report. It only allows you to remove reports based on the type and duration. You could consider using Sophos Central to retain certain reports. See https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=firewall-repor-hub

Dear R,

any update about this?

Kind regards

Hi Markus Hosch ,
Thank you for the feedback. We'll investigate and will update the documentation accordingly.

For the feature request, I'll pass your suggestion to our PM team.