Troubleshooting Tip: How to fix 'Log View' not loading after FortiAnalyzer upgrade to v7.4.6

Description

This article describes how to fix the 'Log View' page not loading after an upgrade to v7.4.6.

Scope

FortiAnalyzer v7.4.6 and onwards.

Solution

The FortiAnalyzer was upgraded to v7.4.6, and after that, the Log View page does not load. 

 
To resolve this issue, run the following command.

diagnose system fsck harddisk

This will reboot the FortiAnalyzer and repair the file system. Also, the FortiAnalyzer database should be rebuilt if necessary.

Before proceeding with the SQL Database rebuild, confirm that the ADOM is allocated enough storage for both Analytics and Archive, and this can be verified through the following command:

diagnose log device

For SQL database rebuild: 

Note that in versions prior to FortiAnalyzer v7.6, the ADOM does not require a restart.

execute sql-local rebuild-adom <AdomName> 
execute sql-local rebuild-db 

For the rebuild, follow the steps outliend in Technical Tip: FortiAnalyzer SQL database delete and rebuild.

In some cases, stopping the FortiSIEM module is also necessary: Technical Tip: How to improve FortiAnalyzer performances when FortiSIEM module is not needed. 

If the issue persists, open a TAC ticket and attach the commands below to the output, running the last line 5 times in the interval of 5 seconds.

diagnose test application fazcfgd 6 db 10
diagnose sql hcache status all
diagnose test app sqlrptcached 2

Also, share the TAC report from FortiAnalyzer:

To save logs to a file, see Technical Tip: How to create a log file of a session using PuTTY.

Execute the following command on FortiAnalyzer:

execute tac report