Technical Tip: Using fetch requests to migrate logs

Description

This article describes how to use Fetch Requests to Migrate Logs between 2 FortiAnalyzer units.

This could be used to run reports on another FortiAnalyzer based upon archive logs. Or as a potentially more selective method of migrating logs over to a new deployment.

Scope

FortiAnalyzer.

Solution

The fetching function is only available if the old FortiAnalyzer instance is still reachable and operational.

Set up a fetch_account on the old FortiAnalyzer:

config system admin user
    edit "fetchadmin"
        set password password
        set profileid "Super_User
        set adom "all_adoms"

Configuration of the Fetch request on the new FortiAnalyzer:

Fetcher Management:

Create a Profile:

Fetcher Request:

Accept the fetching request on the old FortiAnalyzer:

One advantage of log fetching is the ability to filter out unwanted logs based on time.
However, if multiple ADOMs are present, fetching must be configured for each individual.

Debug commands:

execute tac report
diagnose debug app log-fetch 8
diagnose debug enable

Launching the fetching and recording the output on both the sender and receiver:

diagnose test application log-fetch
diagnose test application log-fetch 2
diagnose test application log-fetch 3

diagnose test application log-fetch -> It will display the possible options.