Troubleshooting Tip: Editing a log-forwarder with a large numbers of entries may lead to FortiAnalyzer GUI crash

This article explains a particular series of issues found on FortiAnalyzer.

FortiAnalyzer GUI on 7.4.8 and below may have issues correctly handling log forwarders with a large number of entries:

• The cmdbsvr process gets stuck at 100% completion.
• The GUI freezes for a few seconds (the CLI becomes unresponsive as well).
• The ID of entries changes even if they have not been modified.

This can eventually lead to a crash of the FortiAnalyzer GUI and trigger a failover in an HA scenario, especially in scenarios where the FortiAnalyzer is under heavy logging.

FortiAnalyzer GUI crash example