SpanVA log size limit

Products

• CASB Security Standard
• CASB Security Premium
• CASB Security Advanced
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

Device logs are not processing.  The latest date is not updating.

Please notice that the ball under logs for the data source in question is green and hover message states logs were processed successfully, but no Latest or Earliest Date is displayed. 

Check for large proxy logs uploaded to CloudSOC.  

 

Cause

SpanVA cannot process logs that are too large. 

Resolution

CloudSOC Audit has a limit of 8GB for processing any uploaded log. If a log is uploaded that exceeds the 8GB limit, there is no error message that is generated.

Best Practice, split the large log into smaller pieces, compress, and process the smaller log files. Broadcom recommends logs not exceed 3GB (compressed) in size for optimal processing.