Received/Send bytes differences between Webfilter and Traffic log

[AtiT]

Hello,

Our customer called us that there are some not correct data in reports.

We have a custom report that we are reporting the downloaded files from the websites (HTTP/HTTPS) and shows the username, filename and bytes transferrred (approx. the filesize).

Now I checked the logs and the webfilter log has incorrect sent/received bytes but the traffic log is correct. Webfilter shows 1KB received but the Traffic log shows 75MB (correct).

FortiOS 5.4.5 is used.

Is it a problem on the FortiGate or some settings needed to fine-tune it? Logging behaviour changed in FortiOS 5.4?

We also have a problem with FortiGate on FortiOS 5.4.4 where the downloaded file is logged serveral times with the same date and time causing the 5 MB file showing as 1GB etc. in the report.

Does anyone experienced the same behaviour before?

FAZ version 5.4.3.