Show "Log Storage Policy" using CLI?

[AlexFerenX]

Hi!

whilst configured parameter of "Log Storage Policy" are seen using "diagnose log device", is there a CLI command to show "Actual Logs for X Days" I see in GUI?

Also.. is there a command to show values seen "Analytics Storage Statistics" (when one clicks "Analytics Policy" and graphs in "Log Storage Policy" ?

R's, Alex

[amuda]

Dear @AlexFerenX ,

You may refer here: Displaying logs via FortiGate's CLI - Fortinet Community

[srajeswaran]

Please try "diagnose test application logfiled 4 <ADOM Name> "

diagnose test application logfiled 4 ALL -> to see all ADOM statistics.

Below given are the additional options available.

# diagnose test application logfiled

Logfile Daemon Test Usage:
1: Daemon info (PID, meminfo, backtrace ...)
2: show statistics and state
4: show ADOM statistics ([adom-filter(adom-name or 'ALL' or oid in format of 'oid=123') [force-refresh | dev-filter|* [vd-filter|*]])
5: show device statistics ([devid-filter [vd-filter|*]])
6: show auto-del statistics
7: show log file disk usage ([dev-filter|* [vd-filter|*])
8: update, show log file disk usage ([devid [vd [from-ndays-ago [to-ndays-ago ]]])
9: show inode usage
10: enable or diable debug filter of device and vdom
11: du cache diag commands
12: force to check the oldest log litime when trim log files.
13: force to delete log files older than <days> to enforce deletion policy for uploaded log files (<days>).
90: reset statistics and state
91: force to preen content files info
99: restart daemon

[AlexFerenX]

Thank you, @srajeswaran 

Using argument "4", I see "db=XXX days(actual from ...." and this seems to coincide with Analytics 'Actual Logs for XXX Days' in GUI's Log Storage Policy, however, is there an equivalent for Archive Log?

R's, Alex

[srajeswaran]

"db" refers to "Analytics Logs" and "log" refers to "Archive Logs". So as per below output Analytics logs are assigned with 700MB (70%) , Archive logs are with 300.0MB quota.
Archive logs are configured to keep logs for 365 days and Analytics logs for 60 days, you can also see the actual usage from date and to date on same output, my device don't have any logs.

quota : 1000.0MB(log=300.0MB, db=700.0MB), split_ratio=70%(db), trim_thres=90%
retention : log=365 days, db=60 days(no data), last_chk=7h56m32s(ago) next_chk=4h3m28s(later)

You can also use "diagnose log device" to get details per device.

[AlexFerenX]

Hi @srajeswaran, thanks but I didn’t ask for printout explanation, I asked “is there an equivalent for Archive Log?” - if there is, it’s not in that printout - maybe another? R’s, Alex 

PS. In my FortiAnalyzer I see more information in “retention:” section than you’ve shown.

[srajeswaran]

Can you share the output from your device, i don't have any archive logs in my system so my output may not contain any information regarding archive logs.

[AlexFerenX]

Hi @srajeswaran 

I see:

censored-faz # diagnose test application logfiled 4 root
ADOM root[FSFADOM3] last-dvm-update:2h21m10s(ago) (1718839191)
  quota         : 441.1GB(log=132.3GB, db=308.8GB), split_ratio=70%(db), trim_thres=90%
  retention     : log=365 days, db=60 days(actual from 2024/06/18 00:11:00 to 2024/06/20 01:40:51), last_chk=10h45m(ago) next_chk=1h15m(later)
  log-db        : 276.3GB(SIEM-DB:20.9GB) 89.5%, prev_scan=7m35s(ago), next_scan=5m36s(later), rate=2200566(Bps)
    by-retention: requests=2  last-req=12d22h46m6s(ago) 
    by-quota    : requests=92 last-req=2h58m45s(ago)
  log-files     : 117.7GB 88.9%
    usage       : log=n/a(115.7GB), quar=0(0.0KB), content=0(0.0KB), ips=156569(2.0GB), total=156569(117.7GB)
    by-retention: log=n/a(0.0KB),   quar=0(0.0KB), content=0(0.0KB), ips=60007(34.5MB), total=60007(34.5MB)
    by-quota    : log=n/a(4.0GB),   quar=0(0.0KB), content=0(0.0KB), ips=0(0.0KB),	total=46(4.0GB)
    by-inode    : log=n/a(0.0KB),   quar=0(0.0KB), content=0(0.0KB), ips=0(0.0KB),	total=0(0.0KB)

So, "retention :" shows ... "db=60 days(actual from 2024/06/18 00:11:00 to 2024/06/20 01:40:51)" which refers to Analytics Log, but there's no "actual" for the Achive Logs'  - what I'm asking about.

R's, Alex

[srajeswaran]

Hi @AlexFerenX ,

Thanks for sharing the output, I see your device has archive logs but the "actual" data is missing as observed in my device. I checked further and it looks like the CLI command don't support the actual data for archive logs.

[AlexFerenX]

Hi @srajeswaran, we know GUI shows it - there are only three sources for GUI - client-side JavaScript, CLI command or API call. So, if the command you highlighted doesn’t have it, surely another must - no? R’s, Alex