What log behavior occurs if the memory log buffer is full on a FortiGate with an SDD disk?

When the memory log buffer is full on a FortiGate device with an SDD disk, logs are cached and buffered on the disk. This mechanism is designed to ensure that logging continues smoothly without losing data. The disk space acts as an overflow area for logs that cannot be accepted in real-time due to memory limitations. As a result, logs can still be recorded, allowing administrators to access and analyze all log data without interruption or data loss.

This behavior is essential for maintaining a comprehensive logging system, especially in environments where continuous monitoring and analysis of security events are critical. It allows the system to efficiently manage logs, even when there is a high volume of traffic that could potentially fill up the RAM log buffer quickly. This is a vital feature for devices operating in security-focused roles, where comprehensive logging is necessary for audits and investigations.