Skip to main content
nicko1
nicko1
Visitor III
December 3, 2022
Question

Forticloud Log Analysis

  • December 3, 2022
  • 5 replies
  • 4019 views

Hello, 

 

What is the best solution to interpret / analyze logs downloaded from forticloud. The customer does not have FAZ currently and we have a need to interpret months of traffic logs. 

 

Can we import historical logs from Forticloud to Forti Analyzer cloud? 

 

Will local version of FAZ be able to interpret the logs downloaded from Forticloud?

 

The web filter works great but the limitation of exporting 1000 records is not enough. 

 

Thanks

5 replies

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
December 6, 2022

Hello nicko1!

 

Thank you for posting on the Fortinet Community Forum.

 

I have found these documentations that may help you:

 

https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/189021/logging-traffic-with-fortigate-cloud

 

https://docs.fortinet.com/document/fortianalyzer/6.4.5/administration-guide/982164/importing-a-log-file#:~:text=Go%20to%20Log%20View%20%3E%20Log,ID%20from%20the%20log%20file.

 

Can you tell me if it helps or if you need more pieces of information, please?

 

Kindest regards,

Jean-Philippe - Fortinet Community Team
nicko1
nicko1Author
Visitor III
December 6, 2022

Thanks Jean, to confirm the device logs can be downloaded from forticloud and imported into FAZ?
Is there a way to do this in FAZ Cloud?

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
December 6, 2022

Hello again!

 

Yes that's what it is said in the guide! 

For your other question, you will find help there:

 

https://docs.fortinet.com/document/fortianalyzer/6.4.5/administration-guide/34362/upload-logs-to-cloud-storage

 

Is everything sorted out for you?

 

Kindest regards,

Jean-Philippe - Fortinet Community Team
nicko1
nicko1Author
Visitor III
December 6, 2022

Thanks Jean, my question is can I upload / transfer log files from forticloud to Fortianalyzer in Forticloud (https://fortianalyzer.forticloud.com/)? 
We are already logging to cloud but want to upload or transfer historical logs to the FAZ Cloud service to obtain further granularity? 

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
December 7, 2022

Hello nicko1,

 

You will have instructions with these documents:

 

https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/604952/sending-traffic-logs-to-fortianalyzer-cloud

 

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/658c8641-f465-11ea-96b9-00505692583a/FortiAnalyzer-6.4.x-Cloud_Deployment_Guide.pdf

 

Is that answering your question?

 

Kindest regards,

Jean-Philippe - Fortinet Community Team
    nicko1
    nicko1Author
    Visitor III
    December 13, 2022

    No sorry, I need to know if historical logs can be uploaded to the FAZ Cloud. No mention of historical logs in the documents you provided.

    Jean-Philippe_P
    Staff & Editor
    Jean-Philippe_P
    Staff & Editor
    December 14, 2022

    Hello Nicko1,

     

    I asked one of our engineers and he answered me that, unfortunately, you cannot import logs from devices that are not already logging into FAZ cloud.

     

    Kindest regards,

    Jean-Philippe - Fortinet Community Team
    nicko1
    nicko1Author
    Visitor III
    December 14, 2022

    Thank you, we have also tried to download and import to an on prem FAZ but it appears the forticloud log format is not correct for on prem FAZ. 

    Could confirm that the forticloud logs cannot be imported to on prem FAZ or Forticloud FAZ ? Does fortinet have any other suggestions on how to parse the logs that are uploaded to forticloud, the forticloud web tool only provides 1000 entries which is not enough.

     

    Terms & ConditionsAccessibility statement