Restoring disk content from RMAed FAZ

[aagrafi]

Hello,

Suppose that a FAZ fails and we get a replacement unit via RMA. What is the recommended procedure to recover the log data from the old FAZ to the new one, apart from restore? Can we swap the disks of the two units? Finally, does Fortinet have a way/service to recover the log data from a faulty FAZ?

Thanks

Andreas

[chall_FTNT]

> Can we swap the disks of the two units?

It might be possible on some models but is not a recommended approach.

Either backup/restore or use log aggregation (Collector/Analyzer) to send logs directly from the old to the new FAZ.

For the latter, the following link captures the general idea (specific article to published soon): http://cookbook.fortinet....for-fortianalyzer-5-2/