Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiAnalyzer 7.2.4 Administration Guide
    7.2.4
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.0.12
    6.0.11
    6.0.10
    6.0.9
    6.0.8
    6.0.7
    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0
    5.6.11
    5.6.10
    5.6.10
    5.6.9
    5.6.8
    5.6.7
    5.6.6
    5.6.5
    5.6.4
    5.6.3
    5.6.2
    5.6.1
    5.6.0
    5.4.7
    5.4.6
    5.4.5
    5.4.4
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.2.10
    5.2.9
    5.2.7
    5.2.6
    5.2.5
    5.2.4
    5.2.3
    5.2.2
    5.2.1
    5.2.0
    5.0.13
    5.0.11
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    4.3.0
    4.2.0
    4.1.0
    4.0.0

    Device Manager

    Device Manager

    Use the Device Manager pane to add, configure, and manage devices and VDOMs.

    After you add and authorize a device or VDOM, the FortiAnalyzer unit starts collecting logs from that device or VDOM. You can configure the FortiAnalyzer unit to forward logs to another device. See Log Forwarding.

    You can toggle between a Table View and Map View from the toolbar in Device Manager.

    Table View:

    Three donut charts display above the list of authorized devices:

    • Connectivity

    • Disk Quota Usage

    • Last Log Received Within

    By default, the Show Charts toggle is enabled. You can select which charts appear by selecting them in the Show Charts dropdown, or you can hide all the charts by disabling the Show Charts toggle.

    Mouse over the charts to see more information in a tooltip. Click a section of a chart to filter the charts and the table by that information. You can apply multiple filters across the charts. Once filtered, a filter icon appears next to the chart title; click the filter icon to remove the filter.

    If you create a custom device group, it appears in the Device & Groups tree menu. Select the device group to display information about those devices.

    The Device Manager table view includes the following default columns for authorized devices:

    Column

    Description

    Device Name

    Displays the name of the device.

    Serial Number

    Displays the serial number of the device. The serial number is unique to the unit and does not change with firmware upgrades.

    Platform

    Displays the platform for the device.

    Firmware Version

    Displays the firmware version of the device.

    IP Address

    Displays the IP address for the device.

    Connectivity

    Displays the connectivity status of the device.

    The status is displayed according to the OFTP connection with the logging device:

    • Connection Up: The OFTP connection is up.

    • Connection Down: The OFTP connection is down, or there is currently no OFTP connection when there previously was.

    • Unknown: The logging device has never had an OFTP connection.

    • No Connection (Logs Forwarded): There is no OFTP connection with the logging device. The logs are forwarded from a FortiAnalyzer collector.

    • No Connection (Synced from Primary): There is no OFTP connection with the logging device. The logs are synced from the primary FortiAnalyzer HA unit. This status can only be seen on a secondary FortiAnalyzer HA unit.

    Mouse over the connection icon to view the information in a tooltip, including Logging Mode, Connectivity, Last Log Time, and Encrypted Transmission (enabled or disabled).

    Logging Mode

    Displays the logging mode for the device. A lock icon displays when a secure tunnel is being used to transfer logs from the device to the FortiAnalyzer unit.

    Last Log Time

    Displays the date and time that the last log was received from the device.

    Average Log Rate
    (Logs/Sec)

    Displays the average rate at which the device is sending logs to the FortiAnalyzer unit in log rate per second. Click the number to display a graph of historical average log rates.

    Disk Quota Usage

    Displays how much of the allotted disk storage space has been consumed by logs.

    HA Status

    Displays information if the device is part of a High Availability cluster. You can manually identify devices as part of an HA cluster by editing the device information. See Editing device information.

    Description

    Displays a description of the device.
    Map View:

    The Map View provides an interactive map displaying the physical locations of authorized devices. You can navigate the map by using your mouse. Zoom in or out with the scroll wheel or with the plus (+) or minus (-) buttons on the map. When zoomed in, only the devices that are currently visible on the map are displayed in the sidebar. The sidebar provides information about the devices, including logging status, average log rate, and disk quota usage.

    Previous
    Next

    Device Manager

    Device Manager

    Use the Device Manager pane to add, configure, and manage devices and VDOMs.

    After you add and authorize a device or VDOM, the FortiAnalyzer unit starts collecting logs from that device or VDOM. You can configure the FortiAnalyzer unit to forward logs to another device. See Log Forwarding.

    You can toggle between a Table View and Map View from the toolbar in Device Manager.

    Table View:

    Three donut charts display above the list of authorized devices:

    • Connectivity

    • Disk Quota Usage

    • Last Log Received Within

    By default, the Show Charts toggle is enabled. You can select which charts appear by selecting them in the Show Charts dropdown, or you can hide all the charts by disabling the Show Charts toggle.

    Mouse over the charts to see more information in a tooltip. Click a section of a chart to filter the charts and the table by that information. You can apply multiple filters across the charts. Once filtered, a filter icon appears next to the chart title; click the filter icon to remove the filter.

    If you create a custom device group, it appears in the Device & Groups tree menu. Select the device group to display information about those devices.

    The Device Manager table view includes the following default columns for authorized devices:

    Column

    Description

    Device Name

    Displays the name of the device.

    Serial Number

    Displays the serial number of the device. The serial number is unique to the unit and does not change with firmware upgrades.

    Platform

    Displays the platform for the device.

    Firmware Version

    Displays the firmware version of the device.

    IP Address

    Displays the IP address for the device.

    Connectivity

    Displays the connectivity status of the device.

    The status is displayed according to the OFTP connection with the logging device:

    • Connection Up: The OFTP connection is up.

    • Connection Down: The OFTP connection is down, or there is currently no OFTP connection when there previously was.

    • Unknown: The logging device has never had an OFTP connection.

    • No Connection (Logs Forwarded): There is no OFTP connection with the logging device. The logs are forwarded from a FortiAnalyzer collector.

    • No Connection (Synced from Primary): There is no OFTP connection with the logging device. The logs are synced from the primary FortiAnalyzer HA unit. This status can only be seen on a secondary FortiAnalyzer HA unit.

    Mouse over the connection icon to view the information in a tooltip, including Logging Mode, Connectivity, Last Log Time, and Encrypted Transmission (enabled or disabled).

    Logging Mode

    Displays the logging mode for the device. A lock icon displays when a secure tunnel is being used to transfer logs from the device to the FortiAnalyzer unit.

    Last Log Time

    Displays the date and time that the last log was received from the device.

    Average Log Rate
    (Logs/Sec)

    Displays the average rate at which the device is sending logs to the FortiAnalyzer unit in log rate per second. Click the number to display a graph of historical average log rates.

    Disk Quota Usage

    Displays how much of the allotted disk storage space has been consumed by logs.

    HA Status

    Displays information if the device is part of a High Availability cluster. You can manually identify devices as part of an HA cluster by editing the device information. See Editing device information.

    Description

    Displays a description of the device.
    Map View:

    The Map View provides an interactive map displaying the physical locations of authorized devices. You can navigate the map by using your mouse. Zoom in or out with the scroll wheel or with the plus (+) or minus (-) buttons on the map. When zoomed in, only the devices that are currently visible on the map are displayed in the sidebar. The sidebar provides information about the devices, including logging status, average log rate, and disk quota usage.

    Previous
    Next