Technical Tip: Using log aggregation to migrate logs

Description

This article describes how to use Log Aggregation to Migrate Logs to another (possibly new) FortiAnalyzer, providing an example and some tips for troubleshooting.

This is the recommended approach for migrating logs when both old and new FortiAnalyzer units are simultaneously active. Log aggregation is also useful when using local Collectors to forward logs to a central Analyzer.

Scope

FortiAnalyzer.

Solution

Aggregation is only available if the old FortiAnalyzer is still reachable and operational.

Note: Some low-end FortiAnalyzer models may not be able to act as aggregation servers.

Client side (on the old FortiAnalyzer):

config system log-forward
    edit 1
        set mode aggregation 
        set agg-user aggradmin
        set agg-password password
        set agg-time 1 
        set server-ip
    next
end

set server-ip -> New FortiAnalyzer IP address.

Server-side (on the new FortiAnalyzer):

config system admin user
    edit "aggradmin"
        set password password
        set profileid "Super_User"
        set adom "all_adoms"
end

config system log-forward-service
    set accept-aggregation enable
end

Debug commands:

execute tac report
diagnose debug application log-aggregate 8
diagnose debug enable
execute log-aggregation all.
diagnose sniffer packet any ”port 3000” 3 0 a

execute log-aggregation all -> Specify one aggregation-client entry, or all.