What is the behaviour if I disable local log on Memory but also send log to Forticloud?

[Potato]

Hi Guy,

Just a tricky question.

I am using Fortigate 80C what has no local storage.

So the Log is stored in Ram as known.

Well, then I configure somethings like attached.

My question is,

In my opinion,

If I select the upload option as "Every 5 Minutes",

then these "5 Minutes logs" must be stored somewhere [-- Ram?] before sending it to the cloud.

And when I disable the Local Log on Ram, how does Fortigate handle these "5 Minutes logs"?

[ShawnZA]

Your logs will be sent to the cloud every 5 minutes, probably saved in memory, not sure myself, but disabling the Local Log to memory will have no effect on the 5 minute setting, your logs will go out fine. Used to do that with a old 300C.

But I would just set it to upload in realtime in any case as that's what the documentation says you set it to if you want to upload to the cloud

[Potato]

ShawnZA wrote:

Your logs will be sent to the cloud every 5 minutes, probably saved in memory, not sure myself, but disabling the Local Log to memory will have no effect on the 5 minute setting, your logs will go out fine. Used to do that with a old 300C.

But I would just set it to upload in realtime in any case as that's what the documentation says you set it to if you want to upload to the cloud

I wonder if the Disable Log on Memory + Real-time Logging is going to decrease the memory consuming by FortiOS.

[emnoc]

Probably not but you can graph it in  SNMP and find out. I haven't seen any big impacts with memory usage and those two settings personally.

Ken Felix

[Dave_Hall]

rickywong wrote:

I wonder if the Disable Log on Memory + Real-time Logging is going to decrease the memory consuming by FortiOS.

quote] If your 80C model only has 512 MB memory, you may be pushing the memory constraints with going to later firmwares (e.g. >5.0) - at least in my experience with a bunch of 80CMs on 5.0 and 5.2. Though I don't know what it's like on 5.4/5.6 (we upgraded from 80CMs to 90D/92Ds).  Our stock 4.3 configs loaded (converted) under 5.0/5.1 saw memory usage go up to 65%-70% from a fresh reboot.  We followed the old "Configuration optimization for units with 512MB of RAM running FortiOS 5.0 or 5.2" KB article and the only config change that made a big differences for us is changing the various "buffer" size limits. YMMV.