Troubleshooting Tips: No logs received on FortiAnalyzer

msuhaimi · ‎04-06-2022

Description

This article describes how to troubleshoot no log received FortiAnalyzer VM.

Scope

FortiAnalyzer.

Solution

Check firmware compatibility between FortiGate and FortiAnalyzer: https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/81876198-a54c-11ec-9fd1-fa163e...
Check FortiAnalyzer log setting on FortiGate.

From FortiGate CLI:

config log fortianalyzer setting
get
end

Test for log sending from FortiGate to FortiAnalyzer.

From FortiGate CLI:

execute log fortianalyzer test-connectivity

Get the TAC report from FortiAnalyzer.

execute tac report

Analyze all information/logs obtained.

If FortiGate is sending log to FortiAnalyzer successfully, check for any abnormal logs on FortiAnalyzer tac report.

If this output on FortiAnalyzer tac report is found/observed, this shows that the FortiAnalyzer is constantly out of memory.

<3>[97484.603631] Out of memory: Kill process 21679 (sqllogd) score 93 or sacrifice child
<3>[10818.372025] Out of memory: Kill process 3214 (sqllogd) score 98 or sacrifice child
<3>[10903.445266] Out of memory: Kill process 18473 (sqllogd) score 101 or sacrifice child
<3>[192634.804437] Out of memory: Kill process 31040 (java) score 89 or sacrifice child
<3>[192636.709845] Out of memory: Kill process 31040 (java) score 89 or sacrifice child

Suggest to the customer to increase memory allocation for FortiAnalyzer.