Indexing archive logs for Analytics how to do it? FAZ 7.2.4

[gwaihir]

Hello.

I'm trying to indexing logs from log_browse (archive) to do some analytics, but what are the steps to perform this?

Thank you!

[srajeswaran]

This article explains the procedure - https://community.fortinet.com/t5/Internal-Knowledge-Base-Articles/Technical-Note-How-to-index-logs-...

[gwaihir]

It show denied access, I guess, this is "internal-knowledge-base"

@srajeswaran there is an update with access denied message.

[srajeswaran]

Hi @gwaihir , my apologies, didnt realize it was internal only. Below given is the external one.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-FortiAnalyzer-SQL-database-delete-and-...

Be aware that rebuilding the database is resource and time consuming and the reports as well log view and FortiView will not be fully usable until the rebuild is over.

[jasonhong]

In order to index raw logs into analytics logs, you merely have to run a SQL database rebuild via below command.

# exec sql-local rebuild-db

Below doc guide explains further on archive and analytics logs.

https://docs.fortinet.com/document/fortianalyzer/7.2.4/administration-guide/761825/analytics-and-arc...