what does fortianalyzer work slowly when its logs filtered

were you upgraded from a previous version to 5.0.6? Are you use FortiAnalyzer VM? could you please give an example for the filters you applied?

That seems to be a very basic filter and it should not cause you any problems unless there are other resource intensive activities also running at the same time, eg, a big report is running... have you tried ' exec top' to see what is going on? you can also run ' diag sql proc list' to see the running sql processes. Hope this helps, LC

What FAZ do you have? I have a 100c and it works very slow as well when filtering through logs/creating reports. I only have 28 devices out of 100 connected to it as well.

By chance when you did the upgrade from 5.0.5 did you do a sql database rebuild? That' s a really important step in the process to get everything back up and running smoothly.

I believe I did. Do you have the link for the proper way to see if it was done or how to do it?

The detailed process is in the FortiAnalyzer 5.0.x Release Notes. Here' s one for 5.0.5: docs.fortinet.com/d/fortianalyzer-release-notes-5.0.5/download It' s worth to read every time when you upgrade a host to the next version. Usually the provide details about what you should do before/during/after the upgrade to make sure you will not hit the wall.

thanks, I will check it out and post my results.