Analyzer operation mode

[kinmun]

what is the difference between analyzer mode and collector mode?

currently my FG300D is set to analyzer mode, any impact if I change to collector mode ?

any differenc in the reports generated ?

[AtiT]

Hello kinmun,

Please read the documentation for analyzer: http://docs.fortinet.com/uploaded/files/2376/FortiAnalyzer_Administration_Guide_5.2.2.pdf

page 13 - Opeartion modes

[kinmun]

from the comparison chart between collector and analyzer mode, it says collector mode cannot do reporting.

does it mean that I cannot generate reports in the analyzer ??

[FortiAdam]

Yes that is correct.  In collector mode you lose the ability to create reports or do event handling.  Depending on your configuration and OS version, you may still be able to view parsed logs.  

Personally, I fail to see the benefit of collector mode.  All the features of collector mode are also available in analyzer mode so what's the point?  Log forwarding is easily configured via the CLI while in Analyzer mode.