Fortigate incorrectly counts..??

[Jirka1]

Hi guys,

I have encountered a very strange problem. The management commissioned me to produce an employee report. We have FGT100D (5.6.6) in transparent mode and FAZ200D (6.0.3). This employee uses Bitcoin's wallet on his PC. The problem is that the report shows me that in about 1 week he transferred about 1,3TB of data and his network card on the PC shows about 90GB. The same result (about 90GB) shows our backbone router.

Standart Policy cfg: App control (monitor all), Web filter (some cat forbidden) and cert. inspect. Thats all.

Fortigate is lying? If so, this is a very unpleasant finding - especially because reports are regularly used to check employees ...

Thanks Jirka

[Frosty]

Interesting.  I've been told that my issue is:

"matching the bug 0523445 and fixed in firmware 6.0.5 GA of FortiAnalyzer"

Since I am using 5.6.6 and have no intention of risking v6 firmware yet, I will be waiting 5 months for the fix and will have 5 months worth of bad data as a result.

[Frosty]

I noticed something in recent Release Notes for the Fortianalyzer which referred to "open sessions" having a LogID = 20 and that a "closed session" has a LogID = 13.  This set me wondering whether I could filter out all these buggy not-closed sessions from my Internet usage reporting in the Fortianalyzer (instead of just waiting for a patch from Fortinet, which might take months).

So I have added "and not logid_to_int(logid) = 20" to my dataset query WHERE clauses, like this:

where  $filter  and not logid_to_int(logid) = 20

Initial signs look good.  I have been able to run the query with this added bit in the Where clause and could exactly replicate my original non-buggy report data from back in August (before the Fortigate firmware was upgraded).  When I ran this on current, buggy data, the reporting looks pretty right to me.  The values reported for our Internet usage look plausible again.

Wondering whether you'd like to try this and see whether it works for you too?  It might be a "good enough" workaround until the updated Fortigate firmware comes out?

[enotspe]

Even on logid=13, which is supposed to mean "traffic end", I get logs with same sessionID, and most of them are exactly the same, apart from the date&time. How can a single session end multiple times??? I got to say theses "repeated" logs of the same sessionID are quite few. But still, something seems clearly wrong. I have found this behaivor even running 6.2.3