Forum Discussion

David Caddick's avatar
David Caddick
Iron Contributor
Oct 26, 2020
Solved

Palo Alto Data Connector failing on storage

Hi All, Has anyone else deployed a Log Collector for Palo Alto only to find that it runs out of storage - it's almost like the "Log Collector" itself is not trimming the logs after being parsed thru...
  • Roger_Fleming's avatar
    Roger_Fleming
    Oct 28, 2020

    David Caddick 

    There are two places that you define this depending on the Operating system

     

    In the rsyslog.conf file you will see a line like this

    *.*;auth,authpriv.none          -/var/log/syslog

    *.*;auth,authpriv.none          -/var/log/messages

    Or in the /etc/rsyslog.d/50-default.conf

    *.*;auth,authpriv.none          -/var/log/syslog

    *.*;auth,authpriv.none          -/var/log/messages

     

    The fix is to put a # in front of the line and restart the rsyslog server

     

    Systemctl restart rsyslog

     

    The local file should stop growing

     

    tail -f /var/log/syslog or /var/log/messages

Resources