Technical Tip: How to use ADOM logs rate limit command on FortiAnalyzer

[awasfi_FTNT]

Description	This article explains how to use the ADOM-based log rate limiting feature introduced in FortiAnalyzer v7.0.3, designed to automatically throttle devices generating excessive log traffic.
Scope	FortiAnalyzer.
Solution	By default, there is no log rate limiting for ADOMs. The following command can be used to find out the current rate: diagnose test application fortilogd 18 The rate-Limit column is empty which means the rate is unlimited and no specific value is set. To set lograte, the mode has to be changed to the manual, the filter type will be set to adom and the filter can be set to specific ADOMs or all ADOMs. The following examples will show different usage of log rate limit options based on ADOM: Limit log rate for one or more ADOMs: FORTIANALYZER # config system log ratelimit    (ratelimit)# set mode manual    (ratelimit)# config ratelimits    (ratelimit)# edit 1       (1)# set filter-type adom       (1)# set filter ADOM1       (1)# set ratelimit 6000       (1)# next    (ratelimit)# edit 2       (1)# set filter-type adom       (1)# set filter ADOM2       (1)# set ratelimit 5000       (1)# next    (ratelimit)# end FORTIANALYZER # end In this example, ADOM1 has a limit of 6000 logs per second while ADOM2 has a limit of 5000 logs per second. fortilogd command can be used to check the limit has an effect: diagnose test application fortilogd 18   From the above results, any more logs exceeding the configured limit for the ADOM will be dropped. Limit lograte for all ADOMs: FORTIANALYZER # config system log ratelimit    (ratelimit)# set mode manual    (ratelimit)# config ratelimits    (ratelimit)# edit 1       (1)# set filter-type adom       (1)# set filter *       (1)# set ratelimit 1000       (1)# next    (ratelimit)# end FORTIANALYZER # end In this example, one rate-limit profile will be used and the filter will be set to Asterisk sign (*) to filter by all ADOMs. From Fortilogd command results show all ADOMs assigned the same limit: