Missing event monitor logs after one week on FortiAnalyzer

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

To troubleshoot missing event monitor logs after one week on FortiAnalyzer:

1. Check Log Retention Settings: Verify the log retention settings in FortiAnalyzer. Ensure that the retention period is set appropriately to retain logs for the desired duration.
2. ADOM Quota Utilization: Go to `System Settings -> Storage Info` and select the ADOM with the device. Check the Analytics & Archive utilization. If the usage is high (85% or above), older logs may be deleted to free up space.
3. Device Log Settings: Check the device log settings under the "Advanced" tab. Ensure the "Automatically Delete" section is configured correctly, with the "Device log store duration" set to a value that meets your retention needs.
4. Log Rate Monitoring: Use the CLI command 'diagnose fortilogd lograte' to monitor the log rate. High log rates can lead to rapid consumption of storage space.
5. Lograte Per Device: Use the CLI command 'diag fortilogd lograte-device' to identify devices sending a large volume of logs. This can help pinpoint devices that may be consuming excessive storage.
6. Check for Abnormal Logs: Analyze the FortiAnalyzer TAC report for any abnormal logs or indications of memory issues, which could affect log retention.

Hi, 

the event monitor list is a separated table of the database, you can see a limited size of logs

you can try to extend with

config sys log alert

set max-alert-count 50000 < -- it depends on the version, it may be 100000

end

After upgrading FortiAnalyzer from 7.0.2 to 7.6.2 the SQL event database was partially rebuilt which is why Event Monitor only shows about a week of logs and the “First Occurrence” resets to 3 days ago. The raw logs may still exist on disk but are not fully indexed in SQL. You can confirm this from Log View and by checking System Settings > Storage Info for disk quota. To restore visibility, run a full SQL database rebuild (execute sql-local rebuild-db). If older logs were purged due to quota limits, only restoring from backup will bring them back. In case of SQL corruption, a repair tool like Stellar Repair for MySQL can help recover missing or inaccessible log data.