FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
This article describes how to produce a report on the number of logs of a specific log type, contained in the FortiAnalyzer database (in this example, per-hour-of-day).
Scope
FortiAnalyzer.
Solution
Create datasets for each log type as required (FortiAnalyzer can receive many different log types):
Navigate to Reports -> Dataset.
Create a new Dataset, for example, for the traffic log:
Name: Traffic_Logs_Count
Log type: Traffic
Query:
select daystamp, sum(total_logs) as total_logs
from ###(
select $HOUR_OF_DAY as daystamp, count(*) as total_logs
from $log
where $filter
group by daystamp
order by daystamp
)### t
group by daystamp
order by daystamp
Similarly, create other datasets for the other log types.
Alternatively, the same dataset can include multiple log types (example in the related article below).
Create charts using the datasets:
Once the datasets are ready, create charts using the respective datasets.
This query is suitable for tables, line-charts, and bar-charts.
Report compilation:
Use the report editor.
Add the charts created in step 2.
Notes:
This example is for a very specific case, showing how many logs from a past time remain today in the log database.
The delta between two consecutive HOD samples does not represent the number of logs received by the FortiAnalyzer at the time, especially once the retention limits are reached. This is because the oldest records would eventually be trimmed and removed from the total count.
If run for a period close to the maximum data retention limits, more than once, this query may return different values every time due to the quota enforcement.
If it runs for an extended period of time (a very large number of logs), the result may be incorrect/incomplete due to the report's hcache limits.
To create a report for the real log volume (in GB/day) received by FortiAnalyzer, see the related article below. There are similar stats generated in the FortiAnalyzer event logs, also for the inbound log rate (in logs/sec).
