FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
aportnov
Staff
Staff
Article Id 293955
Description This article provides a dataset that can be used to analyze specific interface bandwidth in FortiAnalyzer. Pre-define the FortiAnalyzer dataset and report (Bandwidth and Application Report) allows to analysis of bandwidth for a device overall only.
Scope FortiAnalyzer.
Solution

In the example below, the inbound (source) and outbound (destination) bandwidth is calculated for both wan1 and wan2 interfaces

  • Create the following SQL dataset that will be used to generate a report:

 

SELECT dom, firewall, interface, sum(byte_sent) AS total_sent, sum(byte_rcvd) AS total_rcvd, sum(byte_total) AS total
FROM (###(
SELECT
$flex_timescale(itime) AS dom, devid AS firewall, srcintf AS interface,
sum(COALESCE(sentbyte, 0)) AS byte_sent,
sum(COALESCE(rcvdbyte, 0)) AS byte_rcvd,
sum(COALESCE(sentbyte, 0) + COALESCE(rcvdbyte, 0)) AS byte_total
FROM $log-traffic
WHERE $filter AND srcintf IN ('wan1', 'wan2')
GROUP BY dom, firewall, interface
ORDER BY dom
)###
UNION ALL
###(
SELECT
$flex_timescale(itime) AS dom, devid AS firewall, dstintf AS interface,
sum(COALESCE(sentbyte, 0)) AS byte_sent,
sum(COALESCE(rcvdbyte, 0)) AS byte_rcvd,
sum(COALESCE(sentbyte, 0) + COALESCE(rcvdbyte, 0)) AS byte_total
FROM $log-traffic
WHERE $filter AND dstintf IN ('wan1', 'wan2')
GROUP BY dom, firewall, interface
ORDER BY dom
)###) t
GROUP BY dom, firewall, interface
ORDER BY dom

 

  • Use the dataset above in the newly created Chart (Table) and then in Report
  • The report interface filter must not be used for specifying the interface as they are already part of the query 

 

* in some cases, $DAY_OF_MONTH AS dom can be used instead of $flex_timescale(itime) AS dom

** Change interface name(s) appropriately in srcintf IN ('wan1', 'wan2') and dstintf IN ('wan1', 'wan2')

 

Related article:

Technical Tip: How to generate data sampling report