FortiAnalyzer store then hunt

Lessons · FortiGate series · FortiAnalyzer store then hunt

Hero · firewall sends, store holds, hunt reads

Why local logs are not a hunt

The day-one ticket is always the same: “FortiGate has the log, so FortiAnalyzer is broken.” Wrong. FortiGate disk / memory logs are a local buffer. FAZ only sees what OFTP delivered, what you authorized into the ADOM you are looking at, and what still sits in Analytics. Three silent-empty states look identical from the SOC chair:

• Device still unauthorized, or authorized into ADOM LAB while you hunt in root.
• OFTP is up, but the policy is logtraffic disable or config log fortianalyzer filter dropped forward-traffic.
• Archive files exist; Analytics quota / insert lag / Collector mode means FortiView, Log View and Reports stay empty.

ADOM, ingest, index — three objects

An ADOM (administrative domain) is the FAZ tenant. When ADOMs are enabled, Device Manager, FortiView, Log View, Incidents & Events and Reports are per ADOM. You pick the ADOM at login. Super_User enables the feature; enabling logs you out. CLI: config system global set adom-status enable. Default is off.

Normal ADOM mode: one FortiGate in one ADOM. Advanced mode: VDOMs from the same FortiGate can sit in different ADOMs — more moving parts, only when you actually split tenants that way. You cannot put the same device in two ADOMs in Normal mode. FortiGate and FortiCarrier never share an ADOM. FortiMail / FortiWeb logging requires ADOMs on.

Path · ADOM, then forward, then index, then hunt

How a log becomes a hunt row

Policy must log. OFTP must deliver. Device must be authorized into this ADOM. Archive write, then SQL insert. Insert lag is a real ticket: Log Receive Monitor climbs, Insert Rate vs Receive Rate diverges, FortiView stays empty. Collector mode receives and archives; it does not FortiView, Report, or run Incidents & Events.

FortiView vs Reports vs Log View

Pick the pane that matches the question. Using Reports for a live brute-force, or FortiView for a PCI PDF, is how you waste an hour on a healthy ingest path.

Runbook Side A / B / C

Side A is ADOM and authorize. Side B is FortiGate send. Side C is hunt and proof. Do not start at Reports.

Side A — ADOM then authorize

1. Enable ADOMs

   Super_User: Dashboards › Status › System Information › Administrative Domain ON. You are logged out. CLI config system global set adom-status enable. Backup first — non-global config moves to root. Source: FortiAnalyzer Administration Guide — Enabling and disabling the ADOM feature.

2. Create ADOM LAB

   System Settings › ADOMs › Create New. Name LAB, type FortiGate. Set Analytics / Archive days and disk quota here — insufficient quota trims Analytics before the scheduled report finishes. Normal mode unless you are splitting VDOMs.

config system global
    set adom-status enable
    set adom-mode normal
end
# GUI: System Settings › ADOMs › Create New › LAB, type FortiGate
# Then Device Manager › authorize FGT-LAB into ADOM LAB

Side B — FortiGate send

1. Point the FortiGate at FAZ

   set server 10.20.20.50, upload-option realtime, reliable enable. Optional: pin set serial to the FAZ serial. Filter: keep forward-traffic enable for this lab.

2. Log on the policy that you will hunt

   LAN-to-WAN: set logtraffic all. Security-event-only hides the HTTPS row you are about to search. Generate traffic from 10.20.20.10 to 203.0.113.80:443.

config log fortianalyzer setting
    set status enable
    set server "10.20.20.50"
    set upload-option realtime
    set reliable enable
end
config log fortianalyzer filter
    set severity information
    set forward-traffic enable
end
config firewall policy
    edit 1
        set name "LAN-to-WAN"
        set logtraffic all
    next
end

Side C — hunt then prove

1. Connectivity from the FortiGate

   execute log fortianalyzer test-connectivity. Want: FortiAnalyzer Adom Name LAB, Registration registered, Connection allow, Log Tx & Rx. Connect Error = IP/route/514. Registered but 0 logs = filter / logtraffic / still unauthorized. Source: FortiOS execute log fortianalyzer test-connectivity; Fortinet Community connectivity tip.

2. Rate on FAZ, then the row

   diagnose fortilogd lograte-device and Dashboards › Status › Log Receive Monitor / Insert Rate vs Receive Rate. Then Log View row for 10.20.20.10. FortiView › Traffic should move after Analytics insert, not before.

3. Handler only after the row exists

   If Log View is empty, diagnose test app sqllogd 200 will not save you. Hit count on the handler increases only after matching Analytics logs. Source: Fortinet Community — event handler troubleshooting.

# FortiGate
execute ping 10.20.20.50
execute log fortianalyzer test-connectivity
# Adom Name: LAB
# Registration: registered
# Connection: allow
# Log: Tx & Rx
get log fortianalyzer setting
diagnose test application fgtlogd 1
# state=connected  reliable=1  server_log_status=Log is allowed.
diagnose test application fgtlogd 4
# faz= count must climb after diagnose log test / real HTTPS

# FortiAnalyzer
diagnose fortilogd lograte
diagnose fortilogd lograte-device
diagnose fortilogd logvol-adom LAB
# GUI: ADOM LAB › Log View › Traffic › srcip 10.20.20.10

One flow after go-live

Host 10.20.20.10 SYN to 203.0.113.80:443. FortiGate policy 1 accepts, logtraffic all. miglogd / fgtlogd OFTP to 10.20.20.50. FAZ oftpd accepts because FGT-LAB is authorized in ADOM LAB. Real-time file in Archive, then sqllogd indexes Analytics. FortiView Traffic widget moves. Log View filter srcip=10.20.20.10 returns the row. A matching event handler can now increment Log chk/hit. A report covering “last 24 hours” can chart it — only while those hours remain inside the Analytics data policy.

Proof · a hunt is a Log View row, not a dashboard tile

# 1) ADOM you are in vs ADOM the device is in
# 2) FortiGate
execute log fortianalyzer test-connectivity
diagnose test application fgtlogd 41
# memory / confirm queue for global-faz — stuck queue = OFTP down
# 3) FAZ widgets: Log Receive Monitor vs Insert Rate vs Receive Rate
# insert rate 0, receive > 0 → SQL insert stuck (sqllogd / quota)
# 4) Log View › Log Browse — files in Archive with no Analytics
# 5) Operation mode: Collector has no FortiView / Reports / Incidents

Traps + proof

Sources

• FortiAnalyzer Administration Guide — Enabling and disabling the ADOM feature; Creating ADOMs; ADOM device modes
• FortiAnalyzer Administration Guide — Analytics and Archive logs (indexed vs compressed; FortiView / Log View / Reports need Analytics)
• FortiAnalyzer Administration Guide — Analyzer and Collector feature comparison
• FortiAnalyzer Administration Guide — FortiView (how ADOMs affect FortiView; logs used for FortiView); Log View / Threat Hunting; Reports; Incidents & Events
• FortiOS Administration Guide — Log settings and targets (config log fortianalyzer setting, upload-option, reliable)
• FortiAnalyzer Administration Guide — Configuring log forwarding (FAZ→FAZ/syslog — not FortiGate ingest)
• Fortinet Community — Troubleshooting Tip: FortiGate to FortiAnalyzer connectivity (execute log fortianalyzer test-connectivity; FAZ diagnose fortilogd lograte)
• Fortinet Community — Event handler troubleshooting (diagnose test app sqllogd 200)

Related: debug flow RCA · debug flow + session · FortiGate command center · VDOMs · Zones, policy, NAT