Logging to FortiAnalyzer
When FortiClient endpoints are on-net and logging to FortiAnalyzer is configured, FortiClient logs are sent to FortiAnalyzer. However, when FortiClient endpoints are off-net, and FortiAnalyzer is not reachable, FortiClient logs are held for the log retention period, and sent to FortiAnalyzer when FortiClient is on-net again. By default, FortiClient logs are held for 90 days. You can control the log retention period by using the <log_retention_days> element in the XML configuration. See the FortiClient XML Reference.