Troubleshooting Tip: FortiView Top Source Addresses and Top Destination Addresses show no record found

Description

This article describes how to fix a possible cause behind the 'Top Source Addresses' and 'Top Destination Addresses' showing 'no record found' in FortiView, while the other sections do.

Scope

All supported versions of FortiAnalyzer and FortiGate.

Solution

These charts rely on the source and destination UUIDs in FortiGate traffic logs.
The option on the FortiGate is disabled by default, as the UUID strings are quite long and will increase the disk usage when enabled.

To enable UUID logging from the FortiGate, go to Log & Report -> Log Settings -> UUIDs in Traffic Log and enable the option.

The corresponding CLI configuration on FortiGate is as follows:

config system global
    set log-uuid-address enable
end

In FortiOS v6.2.x and v6.4.x, extra configuration should be enabled from the GUI as follows:

• 'set log-uuid-policy enable' is configured regarding policy UUID logs.

config system global
    set log-uuid-address enable
    set log-uuid-policy enable 
end

Related articles:

• Technical Tip: How to check SQL Database rebuild progress on FortiAnalyzer

• Technical Tip: FortiAnalyzer SQL database delete and rebuild

• Troubleshooting Tip: No entries are displayed in FortiView after upgrading the FortiAnalyzer