what does fortianalyzer work slowly when its logs filtered

[m_SEA]

when working with fortianalyzer with firmware v5.0.6, by filtering the logs , fortianalyzer works so slowly! I don' t know the reason of this!!! whom could help me?

[L_FTNT]

were you upgraded from a previous version to 5.0.6? Are you use FortiAnalyzer VM? could you please give an example for the filters you applied?

[m_SEA]

yes, upgraded from V5.0.5 no, I don' t use virtual machine. in log view tab, I filter logs of a device with destination IP or/and source/device

[L_FTNT]

That seems to be a very basic filter and it should not cause you any problems unless there are other resource intensive activities also running at the same time, eg, a big report is running... have you tried ' exec top' to see what is going on? you can also run ' diag sql proc list' to see the running sql processes. Hope this helps, LC

[dasilva13]

What FAZ do you have? I have a 100c and it works very slow as well when filtering through logs/creating reports. I only have 28 devices out of 100 connected to it as well.

[FatalHalt]

By chance when you did the upgrade from 5.0.5 did you do a sql database rebuild? That' s a really important step in the process to get everything back up and running smoothly.

[dasilva13]

I believe I did. Do you have the link for the proper way to see if it was done or how to do it?

[Istvan_Takacs_FTNT]

The detailed process is in the FortiAnalyzer 5.0.x Release Notes. Here' s one for 5.0.5: docs.fortinet.com/d/fortianalyzer-release-notes-5.0.5/download It' s worth to read every time when you upgrade a host to the next version. Usually the provide details about what you should do before/during/after the upgrade to make sure you will not hit the wall.

[dasilva13]

thanks, I will check it out and post my results.