FortiAnalyzer missing data in FortiView -> Log View Content

Hi,

May be you are adding the devices to the wrong ADOM version.

If you have FortiGate devices running different firmware versions then you will need to enable ADOM on FortiAnalyzer from GUI "System Settings >> Dashboard >> System Information >> Administrative Domain >> Enable".

Once enabled re-login then you should have "All ADOMs" available under System Settings.

Go to "All ADOMs" and check the devices added to which ADOM version (Under Type).

If for example v5.2 FortiGates added to v5.0 root ADOM which is the default ADOM then create a new ADOM and select the correct firmware version and move v5.2 device to it.

When moving devices from ADOM to another you need to rebuild the database:

# execute sql-local rebuild-db

However since FortiAnalyzer running v5.2.6 then you can use the new command:

#execute sql-local rebuild-adom <adom_name>

This command will rebuild the database for this ADOM only instead of the whole device which may takes up to few hours depends on how big is the database.

Note that while rebuilding the database device will keep receiving logs, however you will not be able to view logs or run reports till finish rebuilding.

Regards,