Downloading Log File From Fortigate

[FortiDave]

Hi,

Ive recently upgraded FGT from 7.0 -> 7.2, and also connected my FGT to a FAZ. 

Prior to these two pieces of work, I could download the past 7 days forward traffic log from the GUI, which would contain the full 7 days.

Since the above pieces of work, when I select the past 7 days, from local disk and with no filter, and try to download the file, it only gives me the first 500 lines of file always, and the same situation with any filter I have in place. 

Is anyone aware of a bug or issues with 7.2, which might be impacting here? Or any reason why I only see first 500 lines?

Dave

[abarushka]

Hello,

It is recommended to view, download, filter logs, etc. on a dedicated logging unit FortiAnalyzer. I would like to ask whether you observe the same issue on FortiAnalizer?

[FortiDave]

Hi,

Because we had a security issue recently, and have only deployed FAZ yesterday, which does not ingest historical logs, or even past 7 days of logs. So I am trying to extract them manually from FGT, to import to FAZ.

I have two issues here:

1. Regarding the file being 500 lines, is there any known issue with 7.2.2 or FAZ being newly introduced?
2. Is it possible to import manually log files from FGT -> FAZ?

Ive followed this article: https://docs.fortinet.com/document/fortianalyzer/6.4.5/administration-guide/982164/importing-a-log-f...

But I always get an error "internal error" when trying to import on FAZ.

Is this a supported method?

[abelio]

Hi,
as with reports, charts, etc and many other objects, import your logs into a FAZ running the same firmware version you 've exported.

If your original logs was exported from a FAZ 7.0.x,  import into new FAZ running the same version. Once imported, you could upgrade to 7.2.x if you wish.