Skip to main content
rrahmanov
rrahmanov
New Member
March 25, 2015
Solved

FortiAnalyzer Event Management, # of events stored

  • March 25, 2015
  • 1 reply
  • 3817 views

I am wondering how Event Management section set up.  Currently, I only see less than 400 events in the Event Management section and that is like 5 day span. I want to be able to go back in the history of far beyond 5 day span, lets say a month worth of events, including acknowledged ones. What type of issue is this and how can I fix it? 

    Best answer by scao_FTNT

    based on FAZ model, different model has different default value for event management table size

     

    FAZ300D default is 200 and FAZ3000D default is 500, and when table usage is 90%+, system will start to delete some old entries for new events

     

    you can change this size in CLI to max 1000

    FAZ300D # conf sys log alert (alert)# set max-alert-count    Maximum number of alerts supported. (alert)# set max-alert-count The    alert count range between 100 and 1000. (alert)# get max-alert-count     : 200 (alert)#

     

    Thanks

     

    simon

    1 reply

    scao_FTNT
    Staff
    scao_FTNTAnswer
    Staff
    March 26, 2015

    based on FAZ model, different model has different default value for event management table size

     

    FAZ300D default is 200 and FAZ3000D default is 500, and when table usage is 90%+, system will start to delete some old entries for new events

     

    you can change this size in CLI to max 1000

    FAZ300D # conf sys log alert (alert)# set max-alert-count    Maximum number of alerts supported. (alert)# set max-alert-count The    alert count range between 100 and 1000. (alert)# get max-alert-count     : 200 (alert)#

     

    Thanks

     

    simon

    rrahmanov
    rrahmanovAuthor
    New Member
    March 26, 2015

    Well, I think we are using FAZVM64 on fortigate 1000c platform. I see 500 is being the max possible number to be shown on the page, so I assume 500 is a max.  Thank you for the CLI guide!

    scao_FTNT wrote:

    based on FAZ model, different model has different default value for event management table size

     

    FAZ300D default is 200 and FAZ3000D default is 500, and when table usage is 90%+, system will start to delete some old entries for new events

     

    you can change this size in CLI to max 1000

    FAZ300D # conf sys log alert (alert)# set max-alert-count    Maximum number of alerts supported. (alert)# set max-alert-count The    alert count range between 100 and 1000. (alert)# get max-alert-count     : 200 (alert)#

     

    Thanks

     

    simon

    Terms & ConditionsAccessibility statement