If the disk quota (raw + SQL) is estimated to be above 95%, what action does FAZ take?

When the disk quota (which encompasses both raw and SQL logs) reaches an estimated level above 95%, the FortiAnalyzer (FAZ) takes a proactive approach to manage storage effectively. The action of removing the raw logs and their corresponding archive logs helps to free up necessary disk space and ensures that the system continues to function without interruption. This is crucial because exceeding the disk quota can lead to various operational issues, including the inability to log new data or potential system instability.

This action is particularly important for maintaining the overall health of the system, as it prioritizes current logging over potentially stale data that may not be as critical for ongoing analysis or security assessments. By managing disk space in this manner, FortiAnalyzer ensures that it can continue to process and store relevant data while adhering to storage limitations.

In contrast, the other options do not directly address the requirement to manage disk space at critical levels. Archiving logs might be one way to retain older data, sending a warning is informative but passive, and increasing the disk quota automatically is not a typical action taken by the system, as it would not resolve the immediate issue of available disk space. Thus, removing the raw logs and their archives is a direct solution to maintain system integrity and continuation of