Special Characters In Report Name

Special characters in report name

FortiAnalyzer version 5.4 does not support the following special characters in report’s name:

\ / ‘ “ > < & , | # ? % $ +

If you wish to import a report, please make sure the above special characters are not used. Otherwise, FortiAnalyzer may not display the name properly.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Generate Reports During The Database Rebuild – FortiAnalyzer 5.4

Generate reports during the database rebuild

After FortiAnalyzer is upgraded, the system may need to rebuild databases due to schema changes. Please note that the ability to generate accurate reports will be affected until the rebuild is complete.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Report Grouping – FortiAnalyzer 5.4

Report grouping

If you are running a large number of reports which are very similar, you can significantly improve report generation time by grouping the reports. Report grouping can reduce the number of hcache tables and improve auto-hcache completion time and report completion time.

Step 1: Configure report grouping

To group reports whose titles contain the string Security_Report and are grouped by device ID and VDOM, enter the following CLI commands:

config system report group
edit 0
set adom root
config group-by
edit devid next edit
vd next

end

set report-like Security_Report

next

end Notes:

  1. The report-like field is the name pattern of the report that will utilize the report-group This string is case-sensitive.
  2. The group-by value controls how cache tables are grouped.
  3. To see a listing of reports and which ones have been included in the grouping, enter the following CLI command:

execute sql-report list-schedule <ADOM>

Step 2: Initiate a rebuild of hcache tables

To initiate a rebuild of hcache tables, enter the following CLI command:

diagnose sql rebuild-report-hcache <start-time> <end-time>

Where <start-time> and <end-time> are in the format: <yyyy-mm-dd hh:mm:ss>.

Step 3: Perform an hcache-check for a given report

Perform an hcache-check for a given report to ensure that the hcache tables exactly match the start and end time frame for the report time period. Enter the following CLI command:

execute sql-report hcache-check <adom> <report_id> <start-time> <end-time>

If you do not run this command, the first report in the report group will take a little longer to run. All subsequent reports in that group will run optimally.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Firmware Image Checksums

Firmware image checksums

The MD5 checksums for all Fortinet software and firmware releases are available at the Customer Service & Support portal, https://support.fortinet.com. To verify the integrity of the download, select the Checksum link next to the HTTPS download link. A dialog box will be displayed with the image file name and checksum code. Compare this checksum with the checksum of the firmware image.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Downgrading to Previous Versions of Firmware

Downgrading to previous versions of firmware

FortiAnalyzer does not provide a full downgrade path. You can downgrade to a previous firmware release via the GUI or CLI, but doing so results in configuration loss. A system reset is required after the firmware downgrading process has completed. To reset the system, use the following CLI commands via a console port connection:

execute reset all-settings
execute format {disk | disk-ext4}


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Stop logging of local broadcasts

So as you may have noticed, your logs can often be filled with local broadcasts and traffic of that sort. You can remove these from your logging to help clean things up. This never crossed my mind until I was reading some other blogs that belong to Fortinet TAM’s, consultants etc. This little tid bit is thanks to FireWall GURU. Below you will see commands on how to do this for specific devices:

FortiAnalyzer:
config log fortianalyzer filter
set local-traffic disable
end

Log Disk
config log disk filter filter
set local-traffic disable
end

Memory:
config log memory filter
set local-traffic disable
end

Syslog
config log syslogd filter
set local-traffic disable
end


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Extended UTM Log For Application Control – FortiAnalyzer 5.4

Extended UTM log for Application Control

For FortiOS 5.0 devices, the application control log is not visible until you enable the extended UTM log in the FortiOS CLI. To enable extended UTM log, use the following CLI command:

config application list
edit [name here]
set extended-utm-log enable
end


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

SQL database rebuild – FortiAnalyzer 5.4

SQL database rebuild

FortiAnalyzer can receive new logs during SQL database rebuild. FortiView, Log View, Event Management, and Reports are also available.However, all scheduled reports are skipped. It is recommended to generate reports only after finishing the database rebuilding process.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!