FortiView from disk

FortiView from disk is available on all FortiGates with an SSD disk.

Restrictions

config log setting
    set fortiview-weekly-data enable
end

Configuration

A firewall policy needs to be in place with traffic logging enabled. For optimal operation with FortiView, internal interface roles should be clearly defined as LAN. DMZ and internet facing or external interface roles should be defined as WAN.

To configure logging to disk in the GUI:

1. Enable disk logging from the FortiGate GUI.
   1. Go to Log & Report > Log Settings > Local Traffic Log.
   2. Select the checkbox next to Disk.
2. Enable historical FortiView from the FortiGate GUI.
   1. Go to Log & Report > Log Settings > Local Traffic Log.
   2. Select the checkbox next to Enable Historical FortiView.

   

3. Click Apply.

To include sniffer traffic and local-deny traffic when FortiView from Disk:

config report setting

set report-source forward-traffic sniffer-traffic local-deny-traffic

end

This feature is only supported through the CLI.

To configure the data source in the GUI:

1. Go to Dashboard > FortiView Sources.
2. Select a time range other than now from the drop-down list to view historical data.
3. In the top menu, click the dropdown, and select Settings. The Edit Dashboard Widget window opens.
   1. In the Data Source area, click Specify.
   2. From the dropdown, select Disk, then click OK.

   For information see, FortiView interface.

Troubleshooting

Use execute report flush-cache and execute report recreate-db to clear up any irregularities that may be caused by upgrading or cache issues.