Hi, we have RSA netwitness deployed in our environment, one thing that confuses me is an alert generated by health and monitoring tab, it says file system is full, does it mean storage or ram? anyways, how can I check for available and used storage, and how can I apply rules to control the duration of storing logs and packets?
Can you confirm on which appliance the filesystem is full?
Generally, logdecoder, concentrator, broker services rollover data post reaching 95%. you can check this by running
df -h command in service putty console.