Report of 'one-arm sniffer interface' data

[anru]

Hi all,

on my FG I've an interface configured as one-arm sniffer interface. Traffic captured can be seen in the Traffic log > Sniffer Traffic and in FortiView sections, but when I try to generate a report there's no data.

Is there a way to generate local report (without using FortiAnalyzer) with sniffer traffic data?

Thanks.

[michaelbazy_FTNT]

Hi Anru,

I have the same behavior here. Still looking, however so far I'd say that it's by design : Logs generated using 1-arm sniffer mode are not injected in the SQL DB.

Were you able to workaround your issue without a FAZ unit?

Thanks and regards,

Michael