Logs Received by Collector but Not Available in Analytics or Log View
I’m experiencing an issue in FortiSIEM environment where devices are successfully communicating with the collector, but their logs are not available for analysis.
Issue Description
The affected devices are present in the CMDB. When expanding the device details and checking the monitoring status, the following indicators appear normal:
- Event Receive Status: Normal (last updated within 5 minutes)
- Ping Status: Normal (last updated within 5 minutes)
However, despite the devices showing as healthy, no logs are visible in the following areas:
- Log View
- Search
- Analytics
- Incidents ( detected Incidents but to events in details )
To verify log ingestion, I executed the following command on the collector:
​tcpdump -i any -nn -A host <DEVICE_IP> and udp port 514
The packet capture confirms that syslog messages from the affected device are being received successfully by the collector.
Despite this, when searching for the device's firewall logs in Analytics, no events are returned, indicating that the logs are not being processed, indexed, or stored after reaching the collector.
Â
