Adding a Disk to the FortiAnalyzer-VM for Logging

You must add another disk to FortiAnalyzer as a log disk.

1. Click Create Block Volume and configure as shown below. The disk size depends on the ordered license. The example below uses 200 GB.

   

2. Once provisioned, return to the FortiAnalyzer instance. Click Attach Block Volume.

   

3. Under Choose how you want to attach your block volume, select either EMULATED or PARAVIRTUALIZED. Under ACCESS, select READ/WRITE.

   

4. Click Attach.

   

5. After attaching the block volume, ensure you reboot (stop and start) the FortiAnalyzer instance. Otherwise, the added disk is not recognized.
6. After the instance has rebooted, log into the FortiAnalyzer-VM management GUI. It may take some time before you are able to connect. You will see that the disk was successfully added. You can check it by running the CLI command exec lvm info. The added 200 GB is shown as Used.

   

   If the status is Unused, enter exec lvm start in the CLI to start LVM disk management. Enter y to continue. The system reboots.

   After rebooting and logging into FortiAnalyzer, the disk should appear as Used. To add additional disks, use exec lvm extend <disk> as shown in steps 4 to 6 here. Check the disk space was added on the Dashboard.

   VM platforms may automatically restart or prompt you to restart when resizing an active VM. As a precaution to prevent database corruption and preserve data in FortiAnalyzer, it is best to backup the logs and perform a graceful shutdown before resizing. For more information, see the FortiAnalyzer Best Practices Guide.