UTM9 log file deletion

I have a similar issue in relation to the auto deletion settings.

My settings are the same

When usage reaches 85% do this: Send notification  

When usage reaches 90% do this: Delete oldest log files

When usage reaches 95% do this: Nothing (as it shouldn't ever reach this level)

I get a number of [INFO-153] messages from every day depending on how busy the appliance is.

It appears from the log entries (below) that this process only runs once a day and as the OP suggested it does not seem to delete enough logs to create space for a day's worth of logs to be stored.

Edit:

Interestingly I do not seem to be sent a [WARN-711] email to indicate that the logs have been deleted even though configured to do so in the Notifications settings.

I subsequently found that I had been recieving the [WARN-711] messages, they are quite informative as they include an attachment detailing all deleted files.

It seems to me that the text in the do this: drop down boxes do not accurately describe the behaviour that is triggered when the threshold is met. And that the help description also does not accurately describe what happens.

It would be useful to be able to set a percentage target to be met when the threshold for deletion is reached.

When usage reaches XX% do this: Delete oldest log files to reach YY%

e.g.

When usage reaches 90% > delete log files to reach 85% used space.

Bringing this down to just below the threshold seems a bit limiting to me, however if the current behaviour was what a customer wanted/needed then they could set it as follows based on my suggestion.

When usage reaches 90% > delete log files to reach 90% used space.

As I have recently set the UTM to copy logs to a remote location this ensures that I can manage these copies based on their age for these files using whatever approach I feel like on the remote storage system, however as there is no (easy?) way to copy all of the historical old log files from the UTM to remote storage.

Once my retention requirement has been met on the remote storage copy I would be able to set the appliance to delete logs after an amount of time, although this does mean that searching these logs would have to be done by something less easy than the UTM built in search features.

I have a similar issue in relation to the auto deletion settings.

My settings are the same

When usage reaches 85% do this: Send notification  

When usage reaches 90% do this: Delete oldest log files

When usage reaches 95% do this: Nothing (as it shouldn't ever reach this level)

I get a number of [INFO-153] messages from every day depending on how busy the appliance is.

It appears from the log entries (below) that this process only runs once a day and as the OP suggested it does not seem to delete enough logs to create space for a day's worth of logs to be stored.

Edit:

Interestingly I do not seem to be sent a [WARN-711] email to indicate that the logs have been deleted even though configured to do so in the Notifications settings.

I subsequently found that I had been recieving the [WARN-711] messages, they are quite informative as they include an attachment detailing all deleted files.

It seems to me that the text in the do this: drop down boxes do not accurately describe the behaviour that is triggered when the threshold is met. And that the help description also does not accurately describe what happens.

It would be useful to be able to set a percentage target to be met when the threshold for deletion is reached.

When usage reaches XX% do this: Delete oldest log files to reach YY%

e.g.

When usage reaches 90% > delete log files to reach 85% used space.

Bringing this down to just below the threshold seems a bit limiting to me, however if the current behaviour was what a customer wanted/needed then they could set it as follows based on my suggestion.

When usage reaches 90% > delete log files to reach 90% used space.

As I have recently set the UTM to copy logs to a remote location this ensures that I can manage these copies based on their age for these files using whatever approach I feel like on the remote storage system, however as there is no (easy?) way to copy all of the historical old log files from the UTM to remote storage.

Once my retention requirement has been met on the remote storage copy I would be able to set the appliance to delete logs after an amount of time, although this does mean that searching these logs would have to be done by something less easy than the UTM built in search features.