Upload Option changed from Realtime to Store & Upload Logs not working correctly

[AtiT]

Hello All,

I have a Fortigate 100D cluster (OSv5.0.10) logging into FAZ-VM (OSv5.0.7) via IPSec. I changed the upload option from realtime to store & upload with parameters: daily 01:00.

But when I check the analyzer I can still see some realtime logs in the log view and also in the fortiview. The IPSec is up all the time.

Why the FortiGate is sending logs to FAZ when realtime is disabled?

The FGT settings:

(setting) # get status              : enable ips-archive         : enable server              : xxx.xxx.xxx.90 encrypt             : enable psksecret           : * localid             : xxx_CLUSTER conn-timeout        : 10 monitor-keepalive-period: 5 monitor-failure-retry-period: 5 source-ip           : 0.0.0.0 upload-option       : store-and-upload upload-interval     : daily upload-time         : 01:00 (setting) #