Skip to main content
gwaihir
Explorer II
December 14, 2023
Question

Indexing archive logs for Analytics how to do it? FAZ 7.2.4

  • December 14, 2023
  • 4 replies
  • 1920 views

Hello.

 

I'm trying to indexing logs from log_browse (archive) to do some analytics, but what are the steps to perform this?

 

Thank you!

4 replies

srajeswaran
Staff
Staff
December 14, 2023
gwaihir
gwaihirAuthor
Explorer II
December 14, 2023

It show denied access, I guess, this is "internal-knowledge-base"

 

@srajeswaran there is an update with access denied message.Log_Error_MSG.PNG

srajeswaran
Staff
Staff
December 15, 2023

Hi @gwaihir , my apologies, didnt realize it was internal only. Below given is the external one.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-FortiAnalyzer-SQL-database-delete-and-rebuild/ta-p/193883?externalID=FD36458

Be aware that rebuilding the database is resource and time consuming and the reports as well log view and FortiView will not be fully usable until the rebuild is over.

jasonhong
Staff & Editor
Staff & Editor
December 15, 2023

In order to index raw logs into analytics logs, you merely have to run a SQL database rebuild via below command.

# exec sql-local rebuild-db


Below doc guide explains further on archive and analytics logs.

https://docs.fortinet.com/document/fortianalyzer/7.2.4/administration-guide/761825/analytics-and-archive-logs

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.