Technical Tip: FortiAnalyzer SQL database rebuild start-time

[Andy_G]

Description

This article describes how to change the start-time of an SQL rebuild.

In FortiAnalyzer, it may occasionally be necessary to delete and rebuild the SQL database. Configuring the start-time allows the administrator to control how much log data is included in the rebuild and, consequently, how far back log searches and reports can extend afterward.

Note: If choosing an earlier data for start-time than Log View currently shows, it may be necessary to modify the Log Storage Policy to ensure enough quota is allocated to Analytic data.

Scope

FortiGate, FortiAnalyzer.

Solution

To rebuild the SQL database with all log entries, check the setting start-time in config system sql.

1. Set the following value to rebuild the database with logs from 2000/01/01

config system sql
     set start-time 00:00 2000/01/01
end

2. Rebuild the SQL database:

execute sql-local rebuild-db

Related article:

Technical Tip: FortiAnalyzer SQL database delete and rebuild