Troubleshooting Tip: FortiAnalyzer log retention days showing incorrect value

Description

This article describes a situation where the FortiAnalyzer log retention days show an incorrect value.

Scope

FortiAnalyzer.

Solution

Context:
Despite being configured to retain logs for 365 days, the user experiences an issue where the FortiAnalyzer is showing a higher number of retention days than expected.

Currently, the days of archive files retained is 492 and the configured days in-policy are 365 days.

Configured days in retention policy:

To resolve the issue of incorrect log retention days on the FortiAnalyzer, follow these steps:

1. Go to System Settings -> ADOMs -> View Storage Info to check the current log retention settings.

2. Check the logview -> logs -> Logbrowse section to see if there are any logs that are older than the configured retention period.

3. Use the logbrowse feature to filter logs by date and identify any logs that are causing the incorrect retention days to be displayed.

4. If it is necessary to see the exact value of the 365 days retention in the GUI, download the files to have a backup of them and then delete the logs that are older than the configured retention period to ensure that the FortiAnalyzer is only retaining logs for the correct amount of time.
   To do so, check the box of the file and select the 'download' button.

5. After deleting any unnecessary logs, restart the logfiled process using the following command to update the log retention days displayed on the FortiAnalyzer GUI.
   
   

diagnose test application logfiled 99

Related documentation:

• Deleting log files

• test

• Configuring log storage policy

• Log storage information