Skip to main content
Beduard
Beduard
New Member
October 30, 2025
Question

New FortiAnalyzer VM Instance receives way to many logs acrording to the license information

  • October 30, 2025
  • 1 reply
  • 550 views

Hello everyone,

 

I have the following problem. We currently still have a FortiAnalyzer 400E in use, but it is being replaced by a FortiAnalyzer VM instance based on Proxmox/KVM.

 

We set up the FortiAnalyzer VM yesterday and connected it to our FortiGate as a second Fortianalyzer. So far, everything is working well and running smoothly. However, I noticed today that the FortiAnalyzer VM is reportedly receiving almost three times as many logs as the FortiAnalyzer 400E.

 

According to the license information in the FortiAnalyzer 400E dashboard, it has received approximately 17.6 GB of logs so far today (see image below). We have only one VDOM, the second one is old and not used anymore. That is why the FortiAnalyzer VM has only one VDOM.

 

Screenshot 2025-10-30 153731.png

 

The FortiAnalyzer VM has received approximately 51 GB in the same period today, at least according to the dashboard (see image below).

 

Screenshot 2025-10-30 153533.png

 

Even on the FortiGate itself, you can see a huge increase in remote logs from around 25 GB per day to 80 GB yesterday, and today it's already almost 70 GB (see image below). Screenshot 2025-10-30 162701.png

The strange thing is that, according to the dashboard, both the FortiAnalyzer 400E and the FortiAnalyzer VM receive almost the same amount of logs. Below are two images of the Log Receive Monitor, the first from the FortiAnalyzer 400E and the second from the FortiAnalyzer VM.

 

Screenshot 2025-10-30 153826.png

Screenshot 2025-10-30 153656.png

 

I have now switched off the FortiAnalyzer VM instance again, as our licensed daily log volume would certainly have been significantly exceeded today.

 

I have been searching for ideas all afternoon, but I haven't found anything yet. I hope one of you has an idea what could be causing the problem.

 

Thank you in advance for your ideas and help.

1 reply

funkylicious
SuperUser
funkylicious
SuperUser
October 30, 2025

hi,

according to the graph from FGT, the huge amount is cause by firewall rules where standard traffic ( L3+L4 ) policy has Log all sessions, most likely.

a best practice would be for traffic where you know the source and destination + port and explicitly define the allow traffic to not log it.

it should not make a difference if FAZ is hardware or VM, if that was the normal amount before it should be maintained.

try running in FAZ cli:

diagnose fortilogd lograte-device

diagnose fortilogd lograte-adom all

diagnose fortilogd lograte-total

diagnose fortilogd lograte

diag log device

"jack of all trades, master of none"
    Beduard
    BeduardAuthor
    New Member
    October 31, 2025

    Hi,

     

    thank you for your ideas! 

     

    Yes, i am fully aware, that we log a huge amount of casual traffic because we use the FortiAnalyzer also for Troubleshooting. So for us that is normal behaviour.

     

    I executed commands on both FAZs and compared the results of the outputs. However, I did not notice any significant deviations.

     

    I think I found the error elsewhere, though.

     

    On the Fortigate itself, I used the commands below to display the connection configuration to the FAZ 400E and the FAZ VM.

     

    --- Command for the first FAZ  the 400E ---


    config log fortianalyzer setting
    show full-configuration

     

    --- Command for the second FAZ the VM ---

     

    config log fortianalyzer2 setting
    show full-configuration

     

    When I compared the output, I noticed that several configuration points were different for the FAZ VM:

     

    • reliable was set to disable
    • enc-algorithm was set to high
    • source ip was emtpy

     

    I used the following commands on the FortiGate CLI to change the settings so they match with the settings for the FAZ 400E

     

    config log fortianalyzer2 setting
    set reliable enable
    set source-ip "IP for the Management Acces to our FortiGate"
    set enc-algorithm high-medium
    end

     

    Both FortiAnalyzers have been running again for a few hours now, and so far it looks like the problem has been fixed. Both continue to show that they are receiving the same number of logs, and the log volume also matches to within 100MB, which is perfectly normal.

     

    I will monitor this over the next few days and then get back to you.

     

    Thanks for your help!

     

     

    Terms & ConditionsAccessibility statement