How to set a thershold for Root volume! Please respond

[sandraimmaculate]

My Security Onion version is 2.4.100, deployed in the cloud. I performed a network installation on a standalone instance with 4 vCPUs, 16 GB RAM, and a 256 GB root volume. The so-status command shows that all services are running, and sudo salt-call state.highstate executed without any errors.
The issue is Even though the root volume still has 24 GB available, the logs are not being stored in Security Onion. If there is a default threshold causing this, how can we increase or decrease it?
For Example i want to set a threshold like if the root volume is 10 GB then it should not stores the logs

[InfosecGoon]

To tweak how much space is reserved on the disk, you need to configure Stenographer and Elasticsearch's thresholds.

Docs:
https://docs.securityonion.net/en/2.4/stenographer.html#disk-free-percentage
https://docs.securityonion.net/en/2.4/elasticsearch.html#so-elasticsearch-indices-delete

[sandraimmaculate]

Thanks for you reply sir

Do I need to change the high threshold to ensure that Elasticsearch stops storing logs when the available disk space reaches 10 GB?

[InfosecGoon]

If you're going to increase the watermark settings, you'd need to increase all three of them.

Keep in mind, though, that you're electing to eliminate disk space; if the disk fills up for some other reason (runaway log file, new kernel package download, etc.) you may be courting problems. Probably better to increase the size of the disk if possible.