When log files are full, you need to select how the firewall system will respond. The possible options may be one or more of the following

• shut down all external interfaces connected to the firewall
• continue to operate, overwriting the oldest entries
• continue to operate without logging

The first option is the preferred one but may not be available with all firewall products. Simulate a firewall log full condition and ensure that the firewall system behaves as expected based on the option you selected.
Select and exercise the appropriate settings for the archival of log files. The settings may include

• log file destination (e.g., a local file on the firewall host or a central
• log file on a remote host)
• number of days before archiving a specified log file
• number of days before purging an archived version of a specified log file