Advise for storage on sg-4860

  • Can someone recommend storage size for my sg-4860?  it currently has a 32 Gig eMMC.
    The main functions this appliance will serve are (packages installed):
    mail report
    ntopng (for monitoring activity / identifying bandwidth hogs)
    squidguard (for web filtering)

    I may experiment with others, but these are the main ones.

    What kind of storage should I get? "Best" size?

    Thanks for any input

  • LAYER 8 Global Moderator

    Why do you think you need more storage?

    How much of your 32GB are you currently using?

  • jonpoz,,

    I honestly do not know,  I read that logs, especially pfblockerng and squidguard really build in size quickly.

    According to my dashboard, on my fresh install, it shows storage as 7% of 20 Gib UFS

    Once I start using these different packages for an office of 6-10 folks, I would imagine the logs would choke the drive?

  • LAYER 8 Global Moderator

    Do you have a growth rate of this usage that you could use to calculate how long your storage would last?  How long do you think you need to keep logs?  Why can you not offload or trim longs after they get to a specific size/retention time?

    You can for sure adjust size of logs and retention time for logs in ntopng and squidguard.. Why you would think pfblockerng would use up large space in logs is misplaced I think.

  • Banned

    I'm using pfBlockerNG for about 3 months now, with some IP and DNSBL lists and the cronjob runs hourly. All the pfBNG logs together are around 2 Mbyte in size. So I don't think you have to worry about that.

    /var/log/pfblockerng: ls -l
    total 491
    -rw-r--r--  1 root  wheel   994321 Feb 15 16:35 dnsbl.log
    -rw-r--r--  1 root  wheel     1736 Feb 15 16:35 dnsbl_error.log
    -rw-r--r--  1 root  wheel     2002 Feb 15 16:00 extras.log
    -rw-r--r--  1 root  wheel      161 Feb  6 23:00 maxmind_ver
    -rw-r--r--  1 root  wheel  1036363 Feb 15 16:00 pfblockerng.log

  • Thanks to all who helped with this!  Once I get it into production I'll watch the logs.  If they start getting too huge I'll re-address the quesiton

Log in to reply