config log disk setting
set diskfull [ overwrite | nolog ]
Action to take when disk is full. The system can overwrite the oldest log messages or stop logging when the disk is full. (default --> overwrite) config log memory global-setting set full-first-warning-threshold {integer} Log full first warning threshold as a percent. (default --> 75) Reference:
https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/421620/config-log-disk-setting
https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/418620/config-log-memory-global-setting C) Logs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%.
This is true because this is the default behavior of FortiGate when logging to the local disk. The local disk is the internal storage of FortiGate that can be used to store event logs and security logs. When the local disk is full, FortiGate will overwrite the oldest logs with the newest ones, and issue warnings at different thresholds of disk usage. The first warning is issued when log disk use reaches 75%, the second warning is issued when log disk use reaches 85%, and the final warning is issued when log disk use reaches 95%. The administrator can configure these thresholds and the action to take when the disk is full using the CLI command config log disk setting1