| Description | This article describes an issue in which, under certain conditions, logs cannot be displayed in the FortiGate GUI when FortiGate Cloud is selected as the log source. In these cases, the GUI displays a red 'Failed to get data' error message when attempting to retrieve log entries. |
| Scope | FortiGate. |
| Solution |
This issue is mainly reported when log queries are performed for a time range longer than 7 days, although it may also be encountered with shorter time ranges, such as 24 hours. While the issue is present, the connection between the FortiGate and FortiGate Cloud is established successfully, and no connectivity-related problems are observed.
The issue is commonly encountered when viewing logs directly from the FortiGate GUI. However, in some cases, the same behavior is also observed when accessing logs from the FortiGate Cloud portal. The error only occurs when filters are applied to the log search. When no filters are used, the logs are displayed correctly.
Typical symptoms include log searches returning 'No results' and a red 'Failed to get data' message when switching from a 1-hour view to 24-hour or 7-day views. In most cases, 1 hour of log history is consistently displayed, 24 hours may intermittently work, and 7 days of history cannot be retrieved. This behavior is observed both from the FortiGate GUI and from FortiGate Cloud.
The root cause of this issue is related to the processing time required for log queries that include multiple filters over extended time ranges. When such queries are sent to FortiGate Cloud servers, the response time may exceed the default connection timeout on the FortiGate device. As a result, the FortiGate terminates the request prematurely and displays the 'Failed to get data' error.
To resolve the issue, the FortiGate connection timeout for FortiGuard logging services should be increased to allow sufficient time for the query to complete. This can be done using the FortiOS CLI with the following commands:
config log fortiguard setting
After increasing the timeout value, filtered log queries for longer time ranges are expected to complete successfully, and the log entries should be displayed correctly. |
