Technical Tip: FortiAnalyzer FortiView session count changes when zooming in

FortiAnalyzer determines session counts based on log entries received from connected FortiGate devices. Each session log recorded by FortiGate is stored and indexed in FortiAnalyzer, which then aggregates these log entries when generating visual reports or analytic charts.

FortiAnalyzer does not plot every raw log entry individually on the FortiView graphs. Instead, it groups data into time intervals so that the graph remains readable and the system performs well, especially over long time ranges.

When a larger time window (for example, a week) is selected:

• Each point on the graph represents the sum of sessions from the previous point up to that point.

• The time between points is longer, so more sessions are included in each point.

• This can make the peaks on the graph look higher.

When the user zooms in to a smaller range (for example, a day):

• The time between points becomes shorter.

• The same total number of sessions is now spread over more points.

• Each point shows a lower value, even though the overall session volume for the period is the same.

• Therefore, it is expected that the value for each point decreases when a smaller time range is selected.

This difference is due to aggregation and time-bucket size, not missing logs or incorrect counting.