Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

/dev/var getting full -> no space for logs

Sophos XGS 3300 v20.0.0:

- got the watermark message that the 80% report limit is reached

/dev/var                179.7G    142.9G     36.8G  80% /var

- when checking the content of /var

12.0K WING
20.0K archieve
235.2M avira4
7.5M certcache
8.9M common-password
1.7M conf
4.2G cores
0 db
8.0K ddclient
4.0K dhclient
4.0K empty
26.9G eventlogs
96.0K exim
4.0K fwcm_data
2.9M garner_db
16.1M httpcache
28.0K import
4.0K input.json
4.0K kdump_config
16.0K lost+found
105.6G newdb
1.2G npu
4.0K nsge_telem.txt
1.7M pdf
4.0K quarantine
8.0K quota_redis
4.0K red_upload_cache
20.0K routing_pre19.5
2.7M run
109.2M sandbox
100.5M sasi
291.7M savi
4.0K sensor_info.json
4.0K sentry
4.0K sni_telemetry
27.4M snort_hspcre.img
8.0K sophos_feedback
676.0K spool
4.0K tls_telemetry
79.5M tmp
1.3G tslog
8.0K u2d
44.0K upload
4.0K waffiles
8.0K webadmin

What is the difference between tslog and eventlogs?
Is there any way to see what log is using the most space? -> how to decide what retention period should be set?

Does the logs under "Log retention Report period" has something to do with the logs in the log viewer? -> other names, much more that in log viewer...

Added TAGs
[edited by: Erick Jan at 10:35 AM (GMT -8) on 29 Feb 2024]