Hello,
We have very simple setup just one Fortigate firewall with estimation of 200 EPS that is 288000 events per day so maximum size is approximately 100MB per day? Would be great if you can provide values from your environment. Regarding indexes deletion that is pretty straitforward that index is deleted from db. I read the links but if you can explain to me in more practical way what is close index. Is information in close index available for search? Indexes that are closed are not stored in RAM (does it have relation to RAM estimation)?
Thank you very much!
Jiri