Skip to main content
markdr_FTNT
Staff
markdr_FTNT
Staff
December 17, 2025

Troubleshooting Tip: Impossible to disable FortiAnalyzer

  • December 17, 2025
  • 0 replies
  • 438 views
Description This article describes an issue where it is not possible to disable FortiAnalyzer logging, as the option to do so is greyed out.
Scope All FortiGates with Security Fabric enabled, and when configured with FortiAnalyzer logging.
Solution

In a scenario where the FortiGate has been enabled with Security Fabric, it is not possible to disable a previously enabled FortiAnalyzer, even if the FortiAnalyzer device has been decommissioned or is otherwise unavailable.

 

The option to disable FortiAnalyzer will be greyed out as shown:

 

FAZ_Cannot_Disable.JPG

 

Attempting to remove (unset) the FortiAnalyzer via the CLI fails with an error (as below), however, this also gives a clue to the reason and also the solution:

 

FGT (global)  config log fortianalyzer setting FGT (setting) unset status  FGT (setting) end At least one FortiAnalyzer or FortiAnalyzer Cloud or FortiGate Cloud log should be enabled for Security Fabric functionality  to work properly. object set operator error, -39, roll back the setting. Command fail. Return code -39

 

The reason for this is that the Security Fabric requires at least one active logging destination.

 

Therefore, this issue can be resolved by enabling FortiGate Cloud logging to satisfy the Security Fabric requirement.

 

To configure cloud logging in the GUI:

  1. Go to Security Fabric -> Fabric Connectors and select the Logging & Analytics card.

  2. On the Cloud Logging tab, set Type to FortiGate Cloud.

 

FGT_Cloud_Logging.JPG

 

By default, the settings for FortiAnalyzer logging are synchronized between all FortiGate in the Security Fabric.
 
To disable the automatic synchronization of these settings, use the following CLI command:
 
config system csf
    set configuration-sync local
end
 

Note:

Starting from FortiOS v7.6.1, command 'set configuration-sync local' is available only on downstream FortiGate.

 

Related documents:
Technical Tip: FortiAnalyzer Cloud is greyed out even though FortiAnalyzer Cloud entitlement is purchased or included in the license 

Technical Tip: The impact of 'set configuration-sync local' on the Security Fabric

Configuring cloud logging 
Terms & ConditionsAccessibility statement