FortiView Sources Bytes "Now"

[scuthber]

Simple question, I thought. I have a bubble chart that shows one of my servers is by far talking the most, but if I select the timescale "now", over what period is "now" actually measured? I have 31.43 GB "Now", but if I switch to 1 hour, I have 535.96 MB. How do you work that out? I'm confused...

[Troubleshooter_73]

If you translate "Now" to "UNTIL Now" and "1 hour" to "LAST 1 hour" it make sense again...

[Debbie_FTNT]

Hey @scuthber,

the confusion is understandable ^^; this needs to be documented a bit better.

'Now' in FortiView/Dashboard displays refers to currently active sessions; the value is just calculated from all active sessions for that IP. Of course, if you have sessions that last a long time, see a lot of traffic, and are still active, that's going to skew the result - all traffic that session has seen over its lifetime is packed into 'now'.

You could have a look at what sessions are active for the source IP you're concerned about, and their duration in particular:

dia sys session filter src <server IP>
dia sys session list | grep duration

Historic data (last five minutes/hour/24 hours/etc) is calculated from traffic logs. FortiGate does write logs when a session is closed, and for ongoing sessions, but depending on the logging settings in your policies, not all traffic might be logged, and thus not all traffic might be accounted for in the historic display.

Hope this helps :)