Fortianalyzer not showing reports longer than 7 days?

[s1awin]

We have a Fortianalyzer collecting data from a Fortigate with multiple VDOM's. Each VDOM has 50Gb of space on the Fortianalyzer for logs and the oldest logs are archived and rotated.

I run a report on a customers VDOM back in mid Feb which showed 5 days of data for the week 12th to the 16th (bandwidth and application).

However if I now run a report from today for the last 30 days it only shows up to the 25th and then shows no data on the report at all?

This conflicts with the earlier report I ran and I know it's been collecting these logs?

I've tried updating it to the latest firmware but no change. Still only shows data on reports for just the last 7 days and no more than that. So for example running a report today which show until the 25th but I bet if I run the same report tmrw the data will stop on the 26th.

Storage info on each VDOM looks fine not near capacity so I'm not sure what's going on. I can't imagine it's a reporting limitation as otherwise it wouldn't have the option to do a 30 day report. What if I wanted to run a report for a 24 hour period back in Jan for example?

Anyone come across this problem?

Thanks

[AEK]

Check your analytics logs retention. Try set it to 30 days.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Analytic-and-Archived-Log-retention-pe...

[jasonhong]

Hi,

Report data is sourced from analytics logs. If you analytics logs actual days is X number of days, the report generated from FortiAnalyzer will only output X number of days worth of data.

Ensure that you have sufficient storage space in your ADOM based on your requirement to store X number of days worth of analytics logs.

Should you need to extend/expand the FortiAnalyzer disk storage, please refer to below KB guide.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-...