Description
This article provides a possible procedure on how to migrate logs between ADOMs on v5.4. The same procedure can be applied for v5.0 and v5.2 ADOM versions.
Scope
FortiAnalyzer.
Solution
This process can be useful if it is necessary to reorganize device logs in a different new ADOM design.
In this case, it is necessary to migrate logs from the original ADOM to another (or new) ADOM. This procedure can be applied only between the same ADOM versions.
Backup configuration:
The backup can be done from the Web GUI.
Or via CLI
In this case, it is necessary to migrate logs from the original ADOM to another (or new) ADOM. This procedure can be applied only between the same ADOM versions.
Backup configuration:
The backup can be done from the Web GUI.
Or via CLI
execute backup all-settings {<devices_str> [ftp | scp | sftp | tftp]<server_ipv4> <username_str> <password_str> <directory_str>}
Example
execute backup all-settings scp 1.2.3.4 /path user1 pwd1
Backup logs for specific FortiGate to migrate.
The backup must be done from CLI:
The backup must be done from CLI:
execute backup logs {<devices_str> [ftp | scp | sftp | tftp]<server_ipv4> <username_str> <password_str> <directory_str>}
Example:
execute backup logs FGVM010000011262 scp 1.2.3.4 user1 pwd1 /home all
Create a new ADOM 5.4 for the FortiGate and move it there. Go to System Settings -> All ADOMs and select 'Create New'.
Add the FortiGate to the new ADOM 5.4 and select 'Ok'.
Check that the FortiGate is in the new ADOM. Go to 'Device Manager' and check the FortiGate is in the new ADOM (ADOM_B)
If it is not yet showing in the new ADOM, try to log out, then login and check again.
Check logs on 'LogView'.
Go to 'Log View' and switch between the 2 ADOMs. The logs should still be seen under the old ADOM (ADOM_A) and new ADOM will be empty (ADOM_B).
Perform SQL rebuild from CLI.
Add the FortiGate to the new ADOM 5.4 and select 'Ok'.
Check that the FortiGate is in the new ADOM. Go to 'Device Manager' and check the FortiGate is in the new ADOM (ADOM_B)
If it is not yet showing in the new ADOM, try to log out, then login and check again.
Check logs on 'LogView'.
Go to 'Log View' and switch between the 2 ADOMs. The logs should still be seen under the old ADOM (ADOM_A) and new ADOM will be empty (ADOM_B).
Perform SQL rebuild from CLI.
execute sql-local rebuild-db
The rebuild process may take a long time (possibly even hours), depending on the size of the database, a reboot will be required.
Check again the logs on 'FortiView'. Go to 'Log View'. The logs should now be seen to have moved under the new ADOM (ADOM-B).
Check again the logs on 'FortiView'. Go to 'Log View'. The logs should now be seen to have moved under the new ADOM (ADOM-B).
Related articles:
Technical Note: How to move a device from one ADOM to another on the FortiAnalyzer
