FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Article Id 195650

When running Fortinet virtual machines (VMs), how do you check that the interfaces on the VM match up with the expected physical NICs on the VM host machine?

The following article shows how to do this by comparing MAC addresses, using FortiAnalyzer or Fortimanager VMs in a VMWare environment as an example. 
A similar approach can be taken for other types of Fortinet VMs and other VM environments.


  1. Go to VM settings >> Network Adapter Advanced Settings, check the MAC address of the network adapter
  2. From the  FortiManager or FortiAnalyzer CLI, run the command: diag fmnetwork interface list, then check that the MAC address matches that of the VM network adapter (step 1).
  3. As needed, configure the VM interface and modify the default gateway on the FortiAnalyzer/FortiManager to match the desired network adapter.

For example, in the screenshot, the VM MAC address matches the port1 MAC address on FMG. Sometimes it does not match port1, (maybe port2).

In this case, port2 is the correct port for Network Adapter 1. Please configure the IP address on port2 instead of port1.