- play_arrow Troubleshooting a Problem
- play_arrow Running Health Checks
- play_arrow Increased DNS Requests
- play_arrow JSA System Notifications
- JSA System Notifications
- Disk Usage System Notifications
- Asset Notifications for JSA Appliances
- Automatic Update Notifications for JSA Appliances
- Custom Rules Notifications for JSA Appliances
- Disk Notifications for JSA Appliances
- Event and Flow Notifications for JSA Appliances
- Failure Notifications for JSA Appliances
- Failure Notifications for QRadar Apps
- High Availability Notifications for JSA Appliances
- License Notifications for JSA Appliances
- Limit Notifications for JSA Appliances
- Log and Log Source Notifications for JSA Appliances
- Memory and Backup Notifications for JSA Appliances
- Offense Notifications for JSA Appliances
- Repair Notifications for JSA Appliances
- Vulnerability Scan Notifications for JSA Appliances
Verifying Disk Usage Levels
The /var/log partition continues to operate when disk usage reaches 100%. However, log data might not be written to the disk, which might affect JSA startup processes and components.
Use SSH to log in JSA or a managed host.
To review the disk partition usage, type the following command:
df -h
Review the partitions to check their disk usage levels.
If any of the monitored partitions reach 95%, see Resolving Disk Usage Issues.
Resolving Disk Usage Issues
File system partitions reach 95% when the data retention period settings are too high or the available storage is insufficient for the rate at which JSA receives data. If you reconfigure your retention bucket storage settings, the storage across your entire JSA deployment is affected.
Identify and remove older debug or patch files in the / file system.
Reduce disk usage on the /store file system.
Choose one of the following options:
Remove the oldest data from the /store/ariel/events file system.
Reduce your data retention period by adjusting the default retention bucket storage settings. For more information, see the Juniper Secure Analytics Administration Guide.
If the /store file is full, identify which log sources you can retain for shorter periods. Use the retention buckets to manage the log sources. For more information, see the Juniper Secure Analytics Administration Guide.
Consider an offboard storage solution such as iSCSI. For more information, see the Juniper Secure Analytics Configuring Offboard Storage Guide.
If the /var/log file system reaches 100% capacity, JSA does not shut down. Other issues might cause your log files to grow faster than expected.
