When there is not enough disk space

When the forensics repository consumes 100 percent of the allotted space (50 GB, by default), a notification is issued, and archiving occurs automatically.

• Automatic archiving starts with the oldest records and continues archiving until at least 15 percent of the allotted disk space is free.
• Archiving includes forensics data, but not incidents.

When this type of automatic archiving is initiated, the system checks to see whether the newly archived data will cause the archive folder to exceed its designated maximum size (50 GB, by default).

• If the addition of new records will make the folder too large, the oldest automatically archived records are deleted to free 10 percent of the archive folder’s maximum size.
• If 10 percent of the allotted space cannot be made available by deleting automatically archived records, a system log message (with a severity of “warning”) is issued.

Configure the size of the archive folder on the Settings > General > Archive Storage page in the Security Manager.

Automatically archived records created when there is not enough disk space are considered private. Forcepoint DLP administrators cannot see them.