FortiManager
FortiManager supports network operations use cases for centralized management, best practices compliance, and workflow automation to provide better protection against breaches.
lingky88
Staff
Staff
Article Id 265326
Description This article describes the steps to take when disabling the FortiAnalyzer feature on FortiManager.
Scope FortiManager.
Solution
  1. Back up the existing logs and reports to an external server.

 

FMG # execute backup logs <device name(s)| all> <ftp/sftp/scp> <ip> <user name> <password> <directory>

FMG # execute backup reports <report name or all> <ftp/sftp/scp> <ip> <user name> <password> <directory>

 

  1. Enable the backend-shell access in FortiManager following the guide below:

     

Reference: Technical Tip: How to enable backend-shell access in FortiManager/FortiAnalyzer.

 

  1. Upon entering the shell, enter the commands as shown below and it will be possible to see the logs stored for the managed FortiGate devices.

     

FMG # exe shell

   Enter password:

   bash$ cd /Storage/Logs

   bash$ ls

 

1. FortiManager shell can see logs for FortiGates.png

 

  1. Disable the FortiAnalyzer Features setting on FortiManager under System Settings -> Dashboard -> System Information -> FortiAnalyzer Features.

2. FortiManager disable FortiAnalyzer feature.png

 

  1. Verify from the shell again to check if the logs are still stored. From the image below, it is still possible to see that managed FortiGate logs are being stored even though the FortiAnalyzer feature is disabled.

1. FortiManager shell can see logs for FortiGates.png

 

  1. Take the current FortiManager backup configuration with FortiAnalyzer feature disabled.

 

3. Take FortiManager config backup.png

 

  1. After that, proceed to format the disk to remove the managed FortiGate logs that are still being stored.

 

FMG # execute format disk

 

4. FortiManager format disk.png

 

  1. After that, restore the FortiManager backup configuration.

     

5. FortiManager restore backup.png

 

  1. After the configuration has been restored, disable Offline Mode under Advanced -> Advanced Settings -> Offline Mode and verify the statuses of the managed devices.

 6. FortiManager disable offline mode.png

 

7. Verify device status.png

 

  1. Lastly, verify on the shell again to see if the managed devices' logs are still stored.

8. No more logs.png