Fortyanalyzer, Logs Loss afther downgrade

[fortimaster]

Hi all,

I had FAZ with last version but, cause I encountered several "cosmetic" problems, I downgraded it to previous 7.2 version. Afther that, I can't find old logs, they are all lost.

I've tried to upgrade to 7.4 version  by uploading a backup but the result is the same. Could you help me to obtain access to these logs? Is it possible?

Thanks ¡¡

[Debbie_FTNT · Accepted solution]

Dear fortimaster,

FortiAnalyzer might have cleared the database during downgrade/upgrade, which would make it seem no logs are present any longer.

Can you please check if log files still exist under Log&Report > Log View?

If you see files there (*.elog, *.tlog) then the actual logs are still there, and simply need to be added back to the database.

A database rebuild should take care of it then:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-FortiAnalyzer-SQL-database-delete-and-...

[fortimaster]

Thanks for your help. The logs are still here. I go to try the first option of your attached link and I'll comment you the result. (exec sql-local rebuild-db)

 

[fortimaster]

Thanks Debbie ¡ It has worked. Afther 2 days rebuilding database and afther  rebooting FAZ, I can see old logs.

Thank you very much for your help.