FortiAnalyzer Log Settings

Forum|Forum|2 years ago
May 31, 2024
6 replies
2999 views

How exactly do we look at the historical logs in FortiAnalyzer? Although 720 days of logs are selected, it shows a maximum of 400 days, what could be the reason for this?

FortiAnalyzer

Sheikh

Staff

Hello @rcpdkc

How are the retention values defined in Fortianalyzer ? This article might help.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-How-to-set-log-retention-values-in-FortiAnalyzer/ta-p/193288

regards,

Sheikh

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

rcpdkcAuthor

Explorer II

When I look at the picture below, it will remain in the device memory for 720 days and when it comes to the top, it will archive, is this information correct?

jasonhong

Staff & Editor

In FortiAnalyzer (FAZ), below are the two key log types.

Archive logs: When a real-time log file in Archive has been completely inserted, that file is compressed and considered to be offline.
Analytics logs or historical logs: Indexed in the SQL database and online.

When viewing the Storage Info based on your screenshot, the 720 days is the number of days worth of Archive logs that you have configured in the ADOM Data Policy. This means that you have configured FAZ to keep 720 days worth of archive logs, assuming there is sufficient disk storage in the ADOM.

To better understand Archive & Analytics logs, you may refer to below doc link.

https://docs.fortinet.com/document/fortianalyzer/7.2.5/administration-guide/761825/analytics-and-archive-logs

rcpdkcAuthor

Explorer II

Also, when I look at this picture, no files will be deleted because there are no adjustments. Is that correct?

jasonhong

Staff & Editor

Yes, you have not configured for automatic log deletion. Hence, FAZ will not proceed to delete logs automatically.

However, log deletion will still happen based on the automatic deletion policies as defined in below doc link.

https://docs.fortinet.com/document/fortianalyzer/7.2.5/administration-guide/87802/automatic-deletion

vraev

Staff

Hi @rcpdkc ,

I would suggest to add more space, but as you already have 14TB in use in some version its possible to hit the 16TB max.
Try to upgrade to the latest and then to expand the space with 5-10 TB above.

Don't forget to use the backup and the upgrade path!!!
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Backup-and-restore-of-FortiAnalyzer-settings-logs/ta-p/191972
https://docs.fortinet.com/document/fortianalyzer/7.4.3/administration-guide/743670/configuring-log-storage-policy

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Archive-vs-Analytic-database/ta-p/208097

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-VM/ta-p/194365

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Adding-additional-space-under-a-KVM-QEMU/ta-p/265607

https://docs.fortinet.com/upgrade-tool/fortianalyzer

Best,