How to compare Fortigate logs sent and the logs received by the FortiAnalyzer?

[badrgb]

Hello,

My question is how can I compare the logs sent from a Gortigate FW in a specific date and the logs received if the FortiAnalyzer in the same date?

Can I do an extract for the "Forwardin logs" in the FW and compare it with an extract from the FortiAnalyzer for the same date? and if I have the same number of line, I will judge that they're no problem in sending/receiving logs?

or they are a better way?

thank you

[Markus_M]

Hi badrgb,

you could export the logs from the FortiAnalyzer directly and go to the FortiGate and export the logs from there, right after selecting to get the logs from disk/memory (upper right of the screen there is a selector for this).

Best regards,

Markus

[badrgb]

Thank you @Markus_M for your reply,

I have the same Idea but I want a confirmation from experts :) , and look if they are a better way (I have a file with over 400000 lines from the fortigate).

Thank you for confirming my idea.