Report Fortianalyzer VM64

[hicham_bouddine1]

Hello, We use the FortiGate as a proxy with the FortiAnalyzer logs. We wish to have the reports Detailed of : - The bandwidth of each group, users, subnet, apllication. Great thx

[L_FTNT]

Could  you please confirm that you need to report on the following:

1. The bandwidth usage for each user group? 

2. The bandwidth usage for each user?

3. The bandwidth usage for each subnet? 

4. The bandwidth usage for each Application? 

which FAZ firmware version do you have? currently for #3, I don't think it's possible for any releases <= 5.2.1 and will be available in 5.2.2

[hicham_bouddine1]

thank you for your answer. I confirm my request and I also add: - Bandwidth for each project. I have version 5.2.1. Thx

[hzhao_FTNT]

1. The bandwidth usage for each user group? Not available now. But you can create a report which contains our predefined chart "Traffic Statistics", then apply group filter under Advanced Setting.

2. The bandwidth usage for each user? Please try predefined chart: Top Users by Bandwidth

3. The bandwidth usage for each subnet? No pre-defined chart right now. But you can create a custom chart based on below query (Top Subnet By Bandwidth): select set_masklen(cidr(srcip),24) as subnet, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) group by subnet having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc

4. The bandwidth usage for each Application? Please try predefined chart: Top Applications by Bandwidth

5. Bandwidth for each project. Not sure if you mean each project = each device. For per device bandwidth report, pls select our predefined "Bandwidth and Applications Report", go to "Configuration" page, select "Multiple Reports (Per-Device)" and run report.

[hicham_bouddine1]

thank you for your answer. the problem with predefined reports, the number of results is limited, for example we can not have the list of all users (max 100). Another issue, the firmeware 5.2.2 Is already available? If this is the case I would like to know how the downloaded.

[hzhao_FTNT · Accepted solution]

For unlimited number of results(up to 10000), you have to clone our predefined chart and set "Only Show First xx Items" to "0".

5.2.2 is not released yet, hopefully we can expect it by the end of this month. 

Regards,

hz