KB NOT WORK! Transferring historical logs from a FortiGate hard disk to a FortiAnalyzer
Hi all,
We have some old logs stored at Fortigate SSD, and we want to export those logs to FAZ to generate a report.
We found the KB and try to do the same:
We have used "lz4_reader.tar.gz" to convert the log to readable format and change to .txt extension.
And we got this error when imported the log to the FAZ via Gui.
---- Update on 7th Nov, 2024.
After checking this issue with Fortinet TAC about the FAZ built-it log format, the FAZ log format is now required as :
[FirrwallSN].[VdomName].[tlog].[Date].[not sure what is it, just a random last Five numbers generated by Firewall?].log
If you follow that KB and try to import something from Fortigate, you might use a " ReNamer " program to change all log naming formats.
I would like to share my script here for easier operation as well.
Hope this helps everyone who suffers the same issue when trying to import an old FGT log to FAZ.
Just import the KB format log to the program and you will get the correct naming:
KB Format:
MY Script to change the naming to correct format:
Success to import now:
