Description
This article discusses a situation that happens after upgrading FortiAnalyzer to v7.4.4 or later, logs disappear from Logview, while log forwarding works fine and FortiAnalyzer ingests logs normally.
Scope
FortiAnalyzer v7.4.4 and later.
Solution
The log view keeps loading and fails to show the logs, instead, it shows a verification failed error as below:
- In v7.4.4 a new command was introduced, when set, it will be used instead of the client host header for any redirection:
config system global
set admin-host
- If setting admin-host with some value, this value will replace the IP in the URL request, FortiAnalyzer will validate the legal URL request by checking the IP in the URL request with the host IP, however, in this case, the value of the hostname is admin-host value instead of the FortiAnalyzer's host IP.
- The IP in the request is not similar to the admin-host value, which is why it fails the verification.
- As a workaround:
config system global
unset admin-host
end
