Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rezafathi
Contributor II

Fortianalyzer exceeds logs

Hi

I am using faz trial license and it says you logs exceeda your limit. So my question is, what happens to logs send to faz after that?

Reza F.
Reza F.
1 Solution
mrafat
Staff
Staff

Hi 
If you have FAZ VM and this VM got the enough storage , nothing will happen to the received logs
However for hardware models of FAZ, logs will start getting dropped

View solution in original post

3 REPLIES 3
AEK
SuperUser
SuperUser

If one notices that the FortiAnalyzer VM has consistently exceeded its licensed GB/day limit for over 7 days, this is a good time to think about a license upgrade and adjust resources. Although FortiAnalyzer VM will try its best not to drop logs, consistently running over capacity will eventually lead to undetermined behavior. This is because all FortiAnalyzer VM functions are validated within the licensed limit; the behavior beyond that limit is deemed to be unsupportable.

 

Ref: 

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Minimizing-logging-from-FortiGate-to-F...

AEK
AEK
Yurisk
SuperUser
SuperUser

There is no definite answer to that - FTNT docs just say "beyond the limit we do not guarantee anything", so it may mean excess logs will be dropped, or may be not - no guarantees. 

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
mrafat
Staff
Staff

Hi 
If you have FAZ VM and this VM got the enough storage , nothing will happen to the received logs
However for hardware models of FAZ, logs will start getting dropped

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors