Troubleshooting Tip: Logview in FortiAnalyzer BigData does not load logs consistently due to Redis exceptions

The 'Log View' tab in FortiAnalyzer BigData is used to view logs of all the authorized devices onboarded (also called Fabric members) in a single pane, which also provides multiple filter options (like device serial number, device name, IP addresses, timestamp durations, etc) to customize the log view to show specific logs. When using firmware versions 7.4.0-7.4.4, the Logview section could intermittently stop loading all the logs in the display and instead show incomplete or empty pages. After several page refresh attempts, it might be able to load the logs.

If this symptom is encountered, in the FortiAnalyzer BigData GUI, navigate to Cluster Manager -> Jobs -> Facet Formation - Reports and check the 'Last Job status'. If it shows failed, select the 'Last Result' log entry for this row and open the log file. Check if the task error shown is a Redis exception, like the example below:

"taskError": "org.springframework.data.redis.RedisSystemException: Unknown redis exception; nested exception is java.util.concurrent.RejectedExecutionException: event executor terminated"

If the above Redis exception is observed in the error log, implement the below Redis pool optimizations to resolve this issue using these two steps:

Step 1.

In the ForitAnalyzer BigData GUI, navigate to Cluster Manager -> Services -> Core -> Configuration -> Query -> Advanced config and add the following Redis config entries (if there are already other entries in this editable text box, append the below two entries at the end of existing configs and do not delete the existing entries). Redis is the in-memory high-performance cache and database engine (among others) in FortiAnalyzer BigData. These two config entries correspond to optimal values for Redis's minimum idle connection settings. Note that these are set as default values in 7.4.5+ versions and are only needed for 7.4.0-7.4.4 firmware versions.

spring.redis.lettuce.pool.min-idle=20
spring.single.redis.lettuce.pool.min-idle=20

After adding the above config, click "Save" at the bottom. This will save the config changes, but these configs have not been applied yet to take effect.

Step 2.

After selecting the 'Save' button in the previous step, FortiAnalyzer BigData will show a guided workflow with tips to navigate to Cluster Manager -> Services -> Core -> Instances -> Query, and there will be an amber or orange warning on top of the 'Apply Config' button for the Query service row. Select the Apply Config button, which will enable the timer changes that were made earlier in Step 1, and it will also restart the Query server (which typically takes a couple of minutes to complete). Verify that the Query service shows 'Healthy' under 'Service State'. Wait if it takes longer to get to the Healthy status before navigating to LogView again.

After the above two steps are completed, navigate to the Logview tab and proceed to retrieve and explore the logs. With the optimal Redis minimum idle connection settings applied, the issue should be resolved, and Logview performance should ideally be back to normal. If the issue continues to persist, contact Fortinet Support for further troubleshooting.