Troubleshooting Tip: Internal error when viewing FortiMail log via FortiAnalyzer supervisor
| Description | This article describes the steps to resolve the internal error that occurs when trying to view FortiMail log via FortiAnalyzer supervisor. |
| Scope | FortiMail, FortiAnalyzer, FortiSandbox. |
| Solution | When using FortiAnalyzer supervisor, selecting Log View -> Logs -> All and then filtering by FortiMail, FortiSandbox (Or any device other than FortiGate), the error message 'Internal error: failed to start fof log search' is displayed, as shown below:
This is happening because the user is accessing 'LogView - All', which are SIEM logs. The device filter in Supervisor is member/ADOM level, so when a user selects 'FortiMail' in the device list, it visits the member's default FortiMail ADOM SIEM logs.
But the default FortiMail ADOM does not support SIEM logs, hence the request is failing. To access FortiMail logs from the supervisor, users need to select Fortinet logs -> FortiMail as shown below:
|
