Troubleshooting Tip: FortiAnalyzer does not show logs for some categories

In this example, FortiAnalyzer does not show Antivirus logs or Intrusion Prevention event logs.

1. Confirm the FortiGate and FortiAnalyzer connectivity.

If the connectivity status does not show up, check this article: Troubleshooting Tip: FortiGate to FortiAnalyzer connectivity 

2. Confirm in FortiGate that configuration profiles have been created and assigned to firewall policies (Antivirus profile and Intrusion Prevention). If they have not, create them and assign them to a firewall policy (the default can be used for test purposes).

In FortiGate Security Profiles -> Antivirus or Security Profiles -> Intrusion Prevention -> Default Profiles -> Antivirus or Security Profiles -> Antivirus -> Default.

3. Confirm the profiles were assigned to a firewall policy that records sessions and logs.

4. Confirm events are recorded (in FortiGate Log & report -> Security Events -> Logs -> Intrusion Prevention or Log & report -> Security Events -> Logs -> AntiVirus). First, use the memory option to confirm events exist in the FortiGate that match the rules.

5. At this point, if no data is displayed, it likely means no related events have been identified. It is therefore normal that FortiAnalyzer does not show any logs. To generate test logs from FortiGate and confirm if the FortiAnalyzer receives them, execute 'diagnose log test' in FortiGate.

6. The logs should appear in FortiGate and FortiAnalyzer after a few minutes. Confirm the events/logs in FortiGate by checking Log & Report -> Security Events -> Logs -> AntiVirus/Intrusion Prevention.

7. After, the logs will be displayed in FortiAnalyzer.

In summary, the issue may be caused by unaddressed problems on the FortiAnalyzer side, and the root cause can be uncovered by testing log generation and reception processes between FortiGate and FortiAnalyzer.