Troubleshooting Tip: 'No Record Found' in the View Logs Panel for Incidents

Incidents in FortiAnalyzer are generated by predefined Event Handlers. In some cases, when navigating to Incidents & Events -> Incidents Handler, selecting an event, and selecting View Logs: the message 'No record found' may appear.
This can happen even though the relevant logs are visible under Log View -> Logs. 

The issue is usually caused by the alert table reaching its maximum size. Increasing the max-alert-count allows FortiAnalyzer to store more alerts and display the corresponding logs in the View Logs section.

Maximum alert count can be increased from the CLI by using the following commands:

config system log alert
    set max-alert-count <integer>
end

The valid range for max-alert-count is 100 to 1,000,000.

After applying this change, the View Logs option under Incidents & Events -> Incidents Handler should display the corresponding logs correctly again.