Information
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.
Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).
Solution
Configure the network device to generate an immediate real-time alert of all audit failure events requiring real-time alerts.
set chassis disk-partition /var level full free-space <0..100>
set chassis disk-partition /var level full free-space percent
set chassis disk-partition /var level high free-space <0..100>
set chassis disk-partition /var level high free-space percent
Note: 'High' disk free-space value must be equal to or greater than 'full' free-space value.
set snmp health-monitor interval <1..2147483647 seconds>
set snmp health-monitor rising-threshold <1..100 percent>
set snmp health-monitor falling-threshold <0..100 percent>
Note: Falling threshold value must be less than the rising-threshold value or commit fails.