New Member

Question

Fortianalyzer not showing logs in Fortiview

Forum|Forum|9 years ago
January 12, 2017
14 replies
31069 views

Hi All,

Good day...!

We have 2 fortigates which are configured to send all the logs to the FortiAnalyzer. The point is that we dont see any logs in "fortiview and log view", but the device is receiving logs. Its stuck like loading the information

Recently we upgraded Fortianalyzer-1000D from version 5.0 to 5.2.5. After upgrading, logs are not showing in Fortiview even rebuild the SQL database.

Already I tried to format the FA and install the firmware 5.2.5 directly, followed the standard way to rebuild the SQL database on multiple times but no luck. Then I restore the backup logs existing firewall logs. There is no much logs in storage even I given enough time to rebuild like a week.

If anyone knows the solution to resolve this issue? expecting your reply

Fortianalyzer 1000D Info:

--------------------

Current version : v5.2.5-build3175 160119 (GA)

Error message in fortiview: "No entry found"

Error message in log view: "No record found"

Log browse: I can see all the logs which is receiving from firewall

sqllogd services utilizing 100% cpu, all other services normal ( exec top)

Log volume in 7 days: 219.64 MB/day

FortiGate 300D Info:

Current Version: v5.2.5,build701 (GA)

Log setting configured to send the log to Fortianalyzer and local HDD

Thanks

Sivaguru D

awasfi_FTNT

Staff

Hello,

There are some known issues on FortiAnalyzer v5.2.5 related to FortiView which have been fixed on v5.2.6 and later.

I think the best if to upgrade to latest v5.2 version v5.2.10.

Regards

sguruAuthor

New Member

Hi,

Thanks for your inputs, I have updated latest version 5.2.10, which is not help me to resolve this issue. Still problem is continuing.

I can't able to see the logs in fortiview => summary view , Log view. If am change the settings in Tools->Real time logs-> am able to see the logs in Log view. This is applicable for all options under Log view.

Already I formatted the FA completely and then restore the images 5.2.5 directly, deleted the sql DB and recreate it, now upgraded to 5.2.10, still my issues not resolved.

I had restore the backup logs of existing 310B firewall also, Is this cause this kind of issue?

Is there any other setting need to be enabled..?

If anyone have idea, please share with me.

Regards, Sguru

awasfi_FTNT

Staff

Hi,

So you are saying real time logs can be seen but historical logs.

>> When you go to log view >> log browse you should see logs files. Can you display the content logs? Select one file and click on display...

>> Did you try different browsers?

>> Did you rebuild the database after restoring the logs or before?

>> Can you enable Administrative Domain and check the ADOM version that the FortiGate belongs to under "System Settings All ADOMs". For example if the root ADOM which the FortiGate added to is on v5.0 then you should create a new v5.2 ADOM and add the FortiGate to it then rebuild the database.

>> Is it possible to capture the output of:

get system status

execute top <<-- use "q" to stop it

get system performance

diagnose dvm device list

diag sql show db-size

diag sql status rebuild-db diag sql status sqlplugind

diag debug crashlog read

Regards,