Giant spike in logs being sent to FM

[adeboer]

Hey All,

A couple days ago we got a massive spike of logs from live devices in the field and the logs were sent back to FM. I attached a screenshot of the jump and I was wondering if there is a way to pinpoint which device/devices caused this?

Thanks,

Alan

[scao_FTNT]

pls try "dia fortilogd msgrate-device"

Thanks

Simon

[adeboer]

That helped a lot. Thank you!

[Pradhumna_FTNT]

Hi Alan,

You can use this command,

diagnose fortilogd msgrate-device

diagnose fortilogd msgrate-type

You can also check if the severity in the log filter settings was changed.

config log fortianalyzer filter

set severity <information>  //ideal configuration

end

Regards, Pradhumna Chandra