Skip to main content
Mohammed_Waked
New Member
February 28, 2025
Question

get logs from fortianalyzer

  • February 28, 2025
  • 4 replies
  • 3217 views

hello guys, i have this part of script where I try to get all logs from fortianalyzer to save in text file 
When i run script, i just get the first 100 logs and any other logs can get it  Knowing that when I changed the offset value to 500, it returned 100 logs different from the first 100. This means that when we change the offset value manually, it works, but when I do this in the script, it only takes 100 logs.

Note that when I do a debug in the Forti Analyzer, it actually shows what is happening in the script and returns only the first 100 logs, but any other request does not return a log.

 

# ----------------------- # Step 4: Retrieve logs using pagination with limit = 100 # ----------------------- all_logs = [] offset = 0 limit = 100  # Use 100 logs per page max_attempts = 3  # Maximum attempts to retry fetching logs  print("\nRetrieving logs in pages...") while offset < total_logs:     logs_payload = {         "id": "123456789",         "jsonrpc": "2.0",         "method": "get",         "params": [             {                 "apiver": 3,                 "offset": offset,                 "limit": limit,                  "url": f"/logview/adom/root/logsearch/{tid}"             }         ],         "session": session_token     }      # Retry mechanism for fetching logs     attempt = 0     while attempt < max_attempts:         logs_resp = requests.post(BASE_URL, json=logs_payload, verify=False)         logs_data = logs_resp.json()          # Debugging: Print the API response         print(f"API Response at offset {offset}:")          # Ensure the data exists in the response         if not logs_data.get("result"):             print(f"Error fetching logs at offset {offset}, response: {logs_data}")             attempt += 1             time.sleep(2)  # Wait before retrying             continue          data = logs_data["result"].get("data", [])         print(f"Retrieved {len(data)} logs at offset {offset}")          if not data:             # If no data is returned, break the retry loop and move to the next offset             break          all_logs.extend(data)         break  # Exit the retry loop if data is fetched successfully      offset += limit  # Move to the next batch  print(f"\nTotal logs retrieved: {len(all_logs)}")  # Save all logs to a text file in JSON format output_filename = "all_logs.txt" with open(output_filename, "w", encoding="utf-8") as f:     json.dump(all_logs, f, indent=4)  print(f"\nSaved {len(all_logs)} logs to {output_filename}")

 

4 replies

Jean-Philippe_P
Staff & Editor
Staff & Editor
March 3, 2025

Hello Mohammed_Waked, 

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

Thanks, 

Jean-Philippe - Fortinet Community Team
Jean-Philippe_P
Staff & Editor
Staff & Editor
March 4, 2025

Hello,

 

We are still looking for an answer to your question.

 

We will come back to you ASAP.

 

Thanks,

Jean-Philippe - Fortinet Community Team
vraev
Staff
Staff
March 4, 2025

Hi @Mohammed_Waked ,

 

Please review:
https://community.fortinet.com/t5/Support-Forum/get-logs-from-fortianalyzer/td-p/379622

{

"id": "123456789",

"jsonrpc": "2.0",

"method": "get",

"params": [

{

"apiver": 3,

"limit": 1000,

"offset": 0,

"url": "/logview/adom/{{adom}}/logsearch/{{tid}}"

}

],

"session": "{{session}}"

}

Tobi
New Member
October 29, 2025

Hi, I'm facing the same issue.

As i understood your solution was changing the limit to 1000 which only changes the issue to a late stage. In my case I have more than 1000 entries and have to work with offset but most of the time I do not get any Logs.

Thats my payload of the API request:

{
"id": 1,
"method": "get",
"jsonrpc": "2.0",
"params": [
{
"apiver": 3,
"limit": 1000,
"offset": 1000,
"url": "/logview/adom/ADOM/logsearch/1995263407"
}],
"session": "{{session}}",
"verbose": 1
}

 

Thats the answer:
{
'jsonrpc': '2.0',
'result':
{
'percentage': 0,
'return-lines': 0,
'total-use-time': 1,
'total-count': 70051,
'scanned-logs': 70051,
'data': [],
'status':
{
'code': 0,
'message':
'succeeded'
},
'tid': 1995263407
},
'id': 1
}

 

Thanks

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT