Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
AlexFerenX
New Contributor II

FortiAnalyzer retention "Keep Logs for Archive" vs auto-deletion

Hi!

I'm trying to understand the relationship between periods specified in "System Settings" -> Storage Info: Data Policy : Keep Logs for Archive"... and "System Settings" -> "Advanced" -> "File Management" : Automatically Delete : "Device log files older than" because they both seem to dictate how long the Archive Logs are retained before deletion.

Are they related? If so, who has higher priority; otherwise, If not related, how are they different?

R's, Alex

 

 

 

1 Solution
ozkanaltas
Valued Contributor III

Hi @AlexFerenX ,

 

I think, there is no option for analytics log settings globally. 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW

View solution in original post

If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
6 REPLIES 6
ozkanaltas
Valued Contributor III

Hello @AlexFerenX ,

 

You can think of the file management area as affecting the global configuration and the storage info area as affecting the adoms.

 

I think, for this reason, the settings on the File management side will override the settings on the storage info side.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
AlexFerenX

Hi @ozkanaltas,

does this mean if "Keep Logs for Archive" (say, "365") number is higher than "Device Log filed older than" (say, "3 Months", ie. 93 days) then actual number of days I have Archive Logs for is the lowest of these two numbers (ie. logs for 93 days, not 365)?

 

Also... Is there such "global" equivalent Analytics Log' database?

R's, Alex

 

ozkanaltas
Valued Contributor III

Hi @AlexFerenX ,,

 

I'm sorry for my late answer.

 

I think FortiAnalyzer will get the value of 3 months. However, the important part is that if the activation button next to these values ​​is off, these values ​​will not work. I think it makes more sense to keep the global one off and make per-adom settings from the adom settings.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
AlexFerenX

Hi @ozkanaltas 

thank you.

Are you able to answer "Also... Is there such "global" equivalent Analytics Log' database?"

R's, Alex

ozkanaltas
Valued Contributor III

Hi @AlexFerenX ,

 

I think, there is no option for analytics log settings globally. 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
AlexFerenX
New Contributor II

Bump.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors