Technical Tip: How to build a custom report on FortiAnalyzer using Chart Builder
Description
This article describes how to run a custom report on a FortiAnalyzer with the Chart Builder tool.
Scope
Any supported version of FortiAnalyzer.
Solution
Make sure to receive the logs on the FortiAnalyzer so that it can be used to generate reports.
Visit this KB article: Troubleshooting Tip: FortiGate to FortiAnalyzer connectivity for reference.
Select a value to run the report in the log view section. Below is an example of a report performed on a 192.168.100.1 source IP and with the DNS protocol.
Select any columns desired to see them in the chart report as follows:
Select the Chart Builder tool from the actions submenu:
Select the columns desired to integrate in the Chart Builder tool (a maximum of 5 may be selected) and run the preview. Give the chart a name and save it.
The 'show Limit' option in the chart limits the number of entries(rows/lines) to be displayed in the report. '0' shows all entries. The configured value can vary like 10,50,100,1000, or whatever value may be required for that specific chart.
(Note: Default charts cannot be edited).
Create the report and go to the Layout section:
Save and run the report:
The report can be viewed in different formats, such as HTML and PDF. It can also be sent by mail.
Troubleshooting:
If a problem occurs, run the report in the CLI and send it using the following steps:
execute tac report
execute sql-report list-schedule <adom>
execute sql-report list <adom>
execute sql-report run <adom> <report ID>
execute sql-report view report-data <adom> "name of the report"
execute sql-report run <adom> <name/title> <start-time> <end-time>
In some cases, FortiAnalyzer's Chart Builder will return an error even though it can generate a SQL query based on configured parameters. If this is the case, run the following debug commands before attempting to save from Chart Builder:
diagnose debug application fazsvcd 255 <----- Maximum-level debug logging for the fazsvcd daemon.
diagnose debug enable
Once the output has been collected, disable the debug:
diagnose debug disable
Related articles:
Technical Tip: Create a custom report using Chart Builder Tool from Log View