Fetcher Management

Log fetching is used to retrieve archived logs from one FortiManager device to another. This allows administrators to run queries and reports against historic data, which can be useful for forensic analysis.

The fetching FortiManager can query the server FortiManager and retrieve the log data for a specified device and time period, based on specified filters. The retrieved data are then indexed, and can be used for data analysis and reports.

Log fetching can only be done on two FortiManager devices running the same firmware. A FortiManager device can be either the fetch server or the fetching client, and it can perform both roles at the same time with different FortiManager devices. Only one log fetching session can be established at a time between two FortiManager devices.

The basic steps for fetching logs are:

1. On the client, create a fetching profile. See Fetching profiles.
2. On the client, send the fetch request to the server. See Fetch requests.
3. If this is the first time fetching logs with the selected profile, or if any changes have been made to the devices and/or ADOMs since the last fetch, on the client, sync devices and ADOMs with the server. See Synchronizing devices and ADOMs.
4. On the server, review the request, then either approve or reject it. See Request processing.
5. Monitor the fetch process on either FortiManager. See Fetch monitoring.
6. On the client, wait until the database is rebuilt before using the fetched data for analysis.

This pane is only available when the FortiAnalyzer features are manually enabled. For more information, see FortiAnalyzer Features.