FortiAnalyzer Reports with archive logs

[Mantiakapra]

Hello!

How can i make Report with data from archive logs. FAZ give me report with logs for last 2 days (analytics), no matter what period of time i use.

Thanks,

NotGoodAdmin

[brazz_FTNT]

Hello Mantiakapra, 

FAZ creates report only from Analytics logs. If you are saying that you have Analytics logs only for 2 days I would suggest to verify the Data and retention policy.

you need to check your Data and retention policy.

 Log browse--->P{46}

If you are willing to use the  Archive logs then DB  needs to  be rebuilt. 

execute sql-local ? execute sql-local rebuild-adom execute sql-local rebuild-db

I have included couple of KBs here for your attention:

  FortiAnalyzer SQL database delete and rebuild

Technical Note: FortiAnalyzer SQL database rebuild start-time

It is highly recommended to create a proper and complete back up before touching the DB. 

  Backup and restore FortiAnalyzer settings, logs and reports

 Let me know if this helps you . 

Cheers