FortiAnalyzer retention "Keep Logs for Archive" vs auto-deletion

[AlexFerenX]

Hi!

I'm trying to understand the relationship between periods specified in "System Settings" -> Storage Info: Data Policy : Keep Logs for Archive"... and "System Settings" -> "Advanced" -> "File Management" : Automatically Delete : "Device log files older than" because they both seem to dictate how long the Archive Logs are retained before deletion.

Are they related? If so, who has higher priority; otherwise, If not related, how are they different?

R's, Alex

[ozkanaltas]

Hello @AlexFerenX ,

You can think of the file management area as affecting the global configuration and the storage info area as affecting the adoms.

I think, for this reason, the settings on the File management side will override the settings on the storage info side.

[AlexFerenX]

Hi @ozkanaltas,

does this mean if "Keep Logs for Archive" (say, "365") number is higher than "Device Log filed older than" (say, "3 Months", ie. 93 days) then actual number of days I have Archive Logs for is the lowest of these two numbers (ie. logs for 93 days, not 365)?

Also... Is there such "global" equivalent Analytics Log' database?

R's, Alex

[ozkanaltas]

Hi @AlexFerenX ,,

I'm sorry for my late answer.

I think FortiAnalyzer will get the value of 3 months. However, the important part is that if the activation button next to these values ​​is off, these values ​​will not work. I think it makes more sense to keep the global one off and make per-adom settings from the adom settings.

[AlexFerenX]

Hi @ozkanaltas 

thank you.

Are you able to answer "Also... Is there such "global" equivalent Analytics Log' database?"

R's, Alex

[ozkanaltas · Accepted solution]

Hi @AlexFerenX ,

I think, there is no option for analytics log settings globally. 

[AlexFerenX]

Bump.