FortiAnalyzer Event Management, # of events stored

[rrahmanov]

I am wondering how Event Management section set up.  Currently, I only see less than 400 events in the Event Management section and that is like 5 day span. I want to be able to go back in the history of far beyond 5 day span, lets say a month worth of events, including acknowledged ones. What type of issue is this and how can I fix it? 

[scao_FTNT · Accepted solution]

based on FAZ model, different model has different default value for event management table size

FAZ300D default is 200 and FAZ3000D default is 500, and when table usage is 90%+, system will start to delete some old entries for new events

you can change this size in CLI to max 1000

FAZ300D # conf sys log alert (alert)# set max-alert-count    Maximum number of alerts supported. (alert)# set max-alert-count The    alert count range between 100 and 1000. (alert)# get max-alert-count     : 200 (alert)#

Thanks

simon

[rrahmanov]

Well, I think we are using FAZVM64 on fortigate 1000c platform. I see 500 is being the max possible number to be shown on the page, so I assume 500 is a max.  Thank you for the CLI guide!

scao_FTNT wrote:

based on FAZ model, different model has different default value for event management table size

FAZ300D default is 200 and FAZ3000D default is 500, and when table usage is 90%+, system will start to delete some old entries for new events

you can change this size in CLI to max 1000

FAZ300D # conf sys log alert (alert)# set max-alert-count    Maximum number of alerts supported. (alert)# set max-alert-count The    alert count range between 100 and 1000. (alert)# get max-alert-count     : 200 (alert)#

Thanks

simon