Total logs for analytics in FortiAnalyzer

[unknown1020]

Friends, a question, I have a fortianalyzer VM. I have several Fortigate devices synchronized with the FAZ for reporting purposes.

Previously, Total records for analysis were displayed: 60 days. Little by little it has been reducing and now I see Total logs for analytics: 20 days.

Could you help me by indicating what this is due to?

"Daily Log Limit Exceeded" alerts are also displayed.

Will this be related to the reduction of Total logs for analytics: 20 day?
I have 9 fortigates teams synchronized with the FAZ.

[ozkanaltas · Accepted solution]

Hello @unknown1020 ,

The answer to your first question is, this is about your storage area. You can set 60 days on configuration for Analytics but if your FortiAnalyzer doesn't have enough space on disk your analytics data keeps just up to your storage space. If you extend your log disk, FortiAnalyzer can keep analytics logs for more than 20 days. 

If you want to get information about how to extend log disk on FortiAnalyzer VM, you can review this document.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-...

The answer to your second question is, that this is related to the daily quota for collecting logs. This is not related to the analytics log. This is about how much logs are processed daily. You can find more information about that in this link.

https://docs.fortinet.com/document/fortianalyzer-private-cloud/7.4.0/vmware-esxi-administration-guid...

[unknown1020]

thanks for the information.

[vraev]

Hi @unknown1020 ,

Review the following documents:

https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/871759/log-storage

https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/062269/log-storage-infor...

https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/761825/analytics-and-arc...
Best,