Total vs. current disk space used in Security Analytics

Products

• Security Analytics

Issue/Introduction

The /pfs and the /etc/solera/flows filesystems will fill to 96% and are monitored.  As more packets come in, the oldest packets are replaced by the newer packets.

The /var/lib/solera/meta partition will fill to 85% and is monitored by background processes and automatically cleaned.  As more metadata comes in, the oldest metadata are replaced by the newer metadata.

Resolution

As more data is added, the oldest will be replaced by newer data.  The filesystems are monitored.

The non-data filesystems should remain below about 50%.  They may work up to 90%, but there will be warnings in the UI and then cleanup routines will bring the disk space usage down again.  Cleanup routines run every 4-6 hours depending on the type of data being stored short term.