Skip to main content
scuthber
scuthber
New Member
November 10, 2021
Question

FortiView Sources Bytes "Now"

  • November 10, 2021
  • 2 replies
  • 4819 views

Simple question, I thought. I have a bubble chart that shows one of my servers is by far talking the most, but if I select the timescale "now", over what period is "now" actually measured? I have 31.43 GB "Now", but if I switch to 1 hour, I have 535.96 MB. How do you work that out? I'm confused...

    2 replies

    Troubleshooter_73
    Troubleshooter_73
    Explorer
    November 17, 2021

    If you translate "Now" to "UNTIL Now" and "1 hour" to "LAST 1 hour" it make sense again...

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    November 18, 2021

    Hey @scuthber,

    the confusion is understandable ^^; this needs to be documented a bit better.

     

    'Now' in FortiView/Dashboard displays refers to currently active sessions; the value is just calculated from all active sessions for that IP. Of course, if you have sessions that last a long time, see a lot of traffic, and are still active, that's going to skew the result - all traffic that session has seen over its lifetime is packed into 'now'.

    You could have a look at what sessions are active for the source IP you're concerned about, and their duration in particular:

    dia sys session filter src <server IP> dia sys session list | grep duration


    Historic data (last five minutes/hour/24 hours/etc) is calculated from traffic logs. FortiGate does write logs when a session is closed, and for ongoing sessions, but depending on the logging settings in your policies, not all traffic might be logged, and thus not all traffic might be accounted for in the historic display.

    Hope this helps :)

      Terms & ConditionsAccessibility statement