FortiGate log buffer

Reliable logging from FortiGate to FortiAnalyzer prevents lost logs when the connection between FortiGate and FortiAnalyzer is disrupted. If connection is lost between the FortiAnalyzer and FortiGate device, logs will be cached and sent to FortiAnalyzer once the connection resumes. For more information, see FortiAnalyzer log caching in the FortiGate / FortiOS Administration Guide.

FortiGates with an SSD disk also have a configurable log buffer. When the connection to FortiAnalyzer is unreachable, the FortiGate is able to buffer logs on disk if the memory log buffer is full. The logs queued on the disk buffer can be sent successfully once the connection to FortiAnalyzer is restored. For more information, see Log buffer on FortiGates with an SSD disk in the FortiGate / FortiOS Administration Guide.