Hello everyone,
I have the following problem. We currently still have a FortiAnalyzer 400E in use, but it is being replaced by a FortiAnalyzer VM instance based on Proxmox/KVM.
We set up the FortiAnalyzer VM yesterday and connected it to our FortiGate as a second Fortianalyzer. So far, everything is working well and running smoothly. However, I noticed today that the FortiAnalyzer VM is reportedly receiving almost three times as many logs as the FortiAnalyzer 400E.
According to the license information in the FortiAnalyzer 400E dashboard, it has received approximately 17.6 GB of logs so far today (see image below). We have only one VDOM, the second one is old and not used anymore. That is why the FortiAnalyzer VM has only one VDOM.
The FortiAnalyzer VM has received approximately 51 GB in the same period today, at least according to the dashboard (see image below).
Even on the FortiGate itself, you can see a huge increase in remote logs from around 25 GB per day to 80 GB yesterday, and today it's already almost 70 GB (see image below).
The strange thing is that, according to the dashboard, both the FortiAnalyzer 400E and the FortiAnalyzer VM receive almost the same amount of logs. Below are two images of the Log Receive Monitor, the first from the FortiAnalyzer 400E and the second from the FortiAnalyzer VM.
I have now switched off the FortiAnalyzer VM instance again, as our licensed daily log volume would certainly have been significantly exceeded today.
I have been searching for ideas all afternoon, but I haven't found anything yet. I hope one of you has an idea what could be causing the problem.
Thank you in advance for your ideas and help.
