Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kinmun
New Contributor II

Analyzer operation mode

what is the difference between analyzer mode and collector mode?

currently my FG300D is set to analyzer mode, any impact if I change to collector mode ?

any differenc in the reports generated ?

3 REPLIES 3
AtiT
Valued Contributor

Hello kinmun,

 

Please read the documentation for analyzer: http://docs.fortinet.com/uploaded/files/2376/FortiAnalyzer_Administration_Guide_5.2.2.pdf

 

page 13 - Opeartion modes

AtiT

AtiT
kinmun
New Contributor II

from the comparison chart between collector and analyzer mode, it says collector mode cannot do reporting.

does it mean that I cannot generate reports in the analyzer ??

FortiAdam
Contributor II

Yes that is correct.  In collector mode you lose the ability to create reports or do event handling.  Depending on your configuration and OS version, you may still be able to view parsed logs.  

 

Personally, I fail to see the benefit of collector mode.  All the features of collector mode are also available in analyzer mode so what's the point?  Log forwarding is easily configured via the CLI while in Analyzer mode.  

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors