FAZ 5.0.7 issues and Fortinet Logging in General

[Paul_S]

I am struggling to get my FAZ-VM 5.0.7 to function properly. I have some tickets open and I have found a few bugs. The FAZ 5.x family seems rough and unrefined. I tried 5.x many months ago, only to downgrade to 4.3, now I have upgraded to 5.0.7 recently to support my FGT that is on 5.2. I really like the FGT 5.2 OS, but the FAZ seems unreliable. What do other fortinet customers do? - Anyone else using FAZ 5.0.7? Do you like it? - If Not Fortianalyzer, then what other solutions do you like for saving and reviewing fortinet logs? we are mostly a windows shop. - Does anyone else have the opinion that the Fortigate family is really great, but the Fortianalyzer family is pretty poor? - Do other competitor Firewall vendor have these type of logging issues?

[Warren_Olson_FTNT]

Paul, Assuming you' ve already enabled the column filter option? ie you can filter by other columns but just not that one?

[Paul_S]

i figured it out. The design changed from 4.3.x. You have to use the time period drop down box and choose custom. Filtering the actual column by date/time is not a feature anymore. I just did not know where to look.

[FatalHalt]

Ah yea, that was a big change over. Glad you got it sorted!

[netmin]

It looks like on FAZ 5.2.0 it is now possible to " download all pages" without browsing to the last page manually (there' s also no last page button). Only the set ' Limit' applies.

[Paul_S]

so you think I should upgrade to 5.2? does it seem stable? I would like the download all pages feature to work. I wonder why there is no last page button. Did you upgrade and run the command to convert your logs?

[netmin]

We haven' t tested a lot on it until now. Yes, we upgraded a 200D from 5.0.7 to 5.2.0 and run exec sql-local rebuild-db. The logs are still received from the FGTs (5.2.0, scheduled upload). FortiView Top xyz views seem now be limited to top 20 - I think this was different in 5.0.7.

[Istvan_Takacs_FTNT]

Haven' t seen anyone answering to the " other vendor' s product to analyse the FGT logs" question. Many SIEM products support FGT log formats and you can build your custom reports around them. Just look around what' s available, and I' m sure you will find some with fancy interface and reporting capabilities. Still I think FAZ does a much better job than any SIEM I had a fortune to work with. If your open issues are difficult to live with then I' d suggest to google for SIEM and Fortigate and I' m sure you will find many available. Even Fortinet publishes a page with official SIEM partners. If your issues are not that significant to get FAZ replaced, then it' s better if you learn to live with them, because it still can provide the best features and reports for analysing FGT logs.

[Paul_S]

thanks.

[oheigl]

The download bug is really annoying, although it' s only a small GUI bug. You can check with the chrome developer tools which URL is requested after you click the download button. There you should see one URL, and in this you need to edit the line value to your desire. Paste this modified link to the browser, and then you are returned the file name of the archive. This file name need to be modified to the usual download link, after that you have correctly downloaded logs. So it' s just a small issue that the web GUI doesn' t forward the actual selected line limit to the requested URL. Seems odd to me that it takes so long to fix a minor issue in the code.

[Rowan_Alberry]

We support and use FortiAnalyzer regularly for many customers. In general we find it very much does what it says on the tin, although with latest versions you do have to be careful to check that you are using a compatible browser version (check release notes). Also if you' re looking for products to augment FortiAnalyzer, then see www.fireplotter.com.