Skip to main content

Check and edit log retention settings

Updated
This article applies only to On-Premise Appliance, not to our Cloud products.

You can view your current log usage and adjust how long your On-Premise Appliance saves logs.

See current and predicted usage

  1. Go to Reports > Settings > Datastore settings to view the total current size of all your logs.
  2. Check how much space each log Object uses in the Current usage tab.


Image 1: Current log usage.

  1. Select the Usage estimates tab to see projected usage for the next month, 3 months, 6 months and 1 year.
    The Appliance calculates this figure by multiplying the average daily data volume by 31. It estimates the number of months data can be stored before the disk's log partition is full.

Image 2: Estimated log usage.

 

Change the retention settings

Datastore settings

The Datastore settings’ Retention settings slider controls the retention period for these Objects shown in the Datastore settings pie chart:

  • Guardian

      Note

    If this Smoothwall Appliance is a child node in a centrally managed setup with Central logging selected in the Child node Node settings, the log retention settings are ignored for Guardian. These logs are kept for seven days.

  • Traffic
  • Email (Deprecated in Maiden)
  • Firewall

      Note

    Consider whether to log data for Firewall rules, as generating these logs can impact the performance of your Smoothwall Appliance. Turn logging on or off for Port Forward policies using the Log connection checkbox, or for Firewall rules or Smoothwall access rules using the Log checkbox.

Your Appliance deletes the oldest logs once the retention period is reached or when the disk becomes full, whichever comes first. If a minimum retention period other than ‘0’ is set, Smoothwall won’t delete any logs of that age or younger.

  1. Go to Reports > Settings > Datastore settings.
  2. Use the Retention settings slider points to adjust the duration for keeping log data.
  3. Minimum: This is set to ‘0’ by default, so all logs have the potential to be deleted. Changing this may cause your disk space to become full.
  4. Maximum: This is set to ‘3’ months by default. Set the maximum to a value that does not exceed the disk space available.
  5. Select Save changes.

For example, if you reduce the maximum retention period from six to four months, the Appliance will delete any logs older than four months. The Appliance will start deleting logs fifteen minutes after you’ve changed the retention period, but the process can take some time depending on the number of logs.

Log settings

The Log settings control retention for the Other and System Objects shown in the Datastore settings pie chart.

  1. Go to Reports > Logs > Log settings.
  2. Edit the settings as needed.
  3. Select Save to apply the changes.

Turn logging on or off

Turn off logging for the different types of Syslogs by clearing the checkboxes:

  • Enable IPSec logs
  • Enable System logs
  • Enable Cron logs (off by default)
  • Enable Datastore logs
  • Enable Datastore Error logs
  • Enable Ultrasurf logs

Change retention periods

The available retention periods are 1 day, 2 days, a week, 2 weeks, a month, 2 months or any number of months up to a year.

In the Syslog logging section:

  • You can leave the Default retention as a month or change it.
  • To set retention periods for individual log types, select Advanced. Change the drop-downs from Default retention to one of the available retention periods for any of these log types:
    • IPSec logs
    • System logs
    • Cron logs
    • Datastore logs
    • Datastore Error logs
    • Ultrasurf logs

In the Other logging section:

  • You can leave the Default retention as a month or change it.
  • To set retention periods for individual log types, select Advanced. Change the drop-downs from Default retention to one of the available retention periods for one or more of these log types:
    • Proxy access logs
    • Intrusion detection logs
    • Intrusion prevention logs
    • Reverse Proxy access logs

Automatic log deletion

Your Appliance deletes the oldest logs first. When logs are deleted depends on whether Automatic log deletion is on.

  • On: When the retention period is reached or when the disk space reaches the percentage set, whichever comes first.
  • Off: When the retention period is reached.

To turn on Automatic log deletion:

  1. Go to the Automatic log deletion section.
  2. Select the Delete old logs when free space is low checkbox.
  3. Leave the Amount of disk space to use for logging as 50% or edit to an increment of 5% up to 95%.
  4. Select Save.

Send logs to a remote server

You can choose to send your System and/or Firewall logs to an external server while also retaining them on your Smoothwall Appliance. For example, to send your Firewall logs to Police CyberAlarm.

  Note

You can’t do this for the Other, Guardian, Traffic, or Email Objects shown in the Datastore settings pie chart.

  1. Go to Reports > Logs > Log settings.
  2. Go to the Syslog logging section.
  3. To send System logs:
    • Select the Remote syslog checkbox.
    • Enter the IP address of the remote Syslog server.
  4. To send Firewall logs:
    • Select the Remote firewall syslog checkbox.
    • Enter the IP address of the remote Firewall Syslog server.
  5. Select Save to apply the changes.