Fortianalzyer Reports - Sometimes work mostly not

[lopri1]

Since upgrading from 4.3.8 to 5.0.7 my reports either come back with nothing or take 12 hours or more to finish or just hang. I' ve been working this with TAC for over 90 days now. I have 620 Firewalls and about 200 reports that are just system templates cloned for different customers. I was told that my 1000c was to small for this and that is why my reports weren' t working even though they were working fine prior to upgrading. Now Fortinet sent me a 3000E and still my reports do not work correctly. Anyone having similar issues with reports in a MSSP model? I really think its a SQL issue but Fortinet seems to have blinders on only focused on hardware, datasets and charts rather than the bigger picture. I also have 4.3 adoms and Fortigates running 4.3.15 and a 5.0 adom and fortigates running 5.0.9 and whats interesting is those in running 5.0 seems to work / report fine. I' ve mentioned this to fortinet but its as if they don' t hear it. Any recommendations / ideas?

[L_FTNT]

Could you list a few report names that do not work for 4.3? are they all cloned from the system templates without any customized queries in it? In general, FAZ 5.x works much better with FGT 5.x, this is because the FAZ 5.0 database schema is based on FGT log format 5.0. There is a major log format change between FOS 4.3 and 5.0: some fields in FOS 4.3 may no longer exist (or have changed to different names) in 5.0; most of these changes have been properly handled in FAZ 5.0 dataset queries, however, it may not handle all the cases. This could be why some of your reports work for 5.0 FGTs but not for 4.3 FGTs after the upgrade. If you have a support ticket ID, you can post here so Fortinet engineers may be able to get more details from the ticket system and take a close look at your problem. LC

[lopri1]

I do have a tac case at level 3 so I don' t want to post it just yet I don' t want to jeopardize the help I am getting thus far. If no progress is made by the end of this week I will post the TAC case # here. Thanks LC

[AtiT]

Hi lopri1, What do you mean with " do not work correctly" ? Do you have " no data" or you have some data but not all? If you click the TEST button on your dataset do you receive the resutls? Are you using report fitlers?