Troubleshooting Tip: FortiAnalyzer report result is using FortiGate security event logs or FortiGate traffic logs

Description

This article describes how to troubleshoot the FortiAnalyzer report result is using FortiGate security event logs or FortiGate traffic logs.

Scope

FortiAnalyzer.

Solution

FortiAnalyzer report has a different dataset; therefore, it can end up using either FortiGate security event logs or FortiGate traffic logs or both.

Using the 'User Detailed Browsing Log' report as an example.

Without any filter, the report will show the results for both Action = allow and block.

When the 'User Detailed Browsing Log' report (add filter information: action = blocked), but report result does not generate as expected.

At FortiAnalyzer, for FortiGate Security Event Logs result (Formatted Log Format and Raw Log Format).
Security Event Logs: action = blocked.

At FortiAnalyzer, for FortiGate Traffic Logs result (Formatted Log Format and Raw Log Format).

Traffic Logs: utmaction = block.

Therefore, check the related Dataset information, which will mention about the filter information.

In this example, the SQL query mentions using 'utmaction'.

After that, go back to the report, change the report filter information based on the SQL query, and follow the FortiGate logs syntax.

In this example, filter information: utmaction = block.