Technical Tip: FortiAnalyzer log rate and log forwarding status using API

Description

This article describes how to check the FortiAnalyzer log rate history and log forwarding Status using the API.

Scope

FortiAnalyzer v7.6.

Solution

Use the following API call to check Log Rate History:

{
    "id": "3",
    "jsonrpc": "2.0",
    "method": "get",
    "params": [
        {
            "url": "/fazsys/adom/{{ADOM}}/lograte/history",
            "time-range": {
                "start": "<YYYY-MM-DD HH:MM>",
                "end": "<YYYY-MM-DD HH:MM>"
            },
            "apiver": 3
        }
    ],
    "session": "{{session}}"
}

Sample output:

{
    "jsonrpc": "2.0",
    "id": "3",
    "result": {
        "status": {
            "code": 0,
            "message": "OK"
        },
        "data": [
            {
                "timestamp": "1772352000",
                "timespan": "86400",
                "log-count": "75",
                "lograte-avg": "4.01",
                "lograte-max": "4.01"
            },
            {
                "timestamp": "1772438400",
                "timespan": "86400",
                "log-count": "75",
                "lograte-avg": "4.39",
                "lograte-max": "4.39"
            }
        ]
    }
}

Here:

• log-count = The total log count during the timespan.

• lograte-avg = The average log rate in this timespan.

• lograte-max = The maximum log rate in this timespan.

Use the following API call to check Log Forwarding Status:

{
    "id": "3",
    "jsonrpc": "2.0",
    "method": "get",
    "params": [
        {
            "url": "/fazsys/monitor/logforward-status",
            "apiver": 3
        }
    ],
    "session": "{{session}}"
}

Sample output:

{
    "jsonrpc": "2.0",
    "id": "3",
    "result": {
        "status": {
            "code": 0,
            "message": "OK"
        },
        "data": [
            {
                "id": 1,
                "status": "connected",
                "lograte": 0.000000
            },
            {
                "id": 2,
                "status": "connected",
                "lograte": 0.000000
            }
        ]
    }
}

This output shows there are two log forwarders with status connected, here: lograte = The average log rate (logs/sec) in the last 60 seconds.

Troubleshooting:

The following commands can be used on the FortiAnalyzer CLI to debug the API calls:

diagnose debug service httpd 255

diagnose debug service main 255

Related documents:

Fortinet Development Network (FNDN)

Technical Tip: Performance info from CLI, GUI and API call of FortiAnalyzer and FortiManager

Technical Tip: Storage information from CLI, API call and GUI of FortiAnalyzer and FortiManager