Technical Tip: Meaning of FortiSandbox counter 'Total Scanned' in Dashboard

[mtse]

Description	This article describes the meaning of 'Total Scanned' in Dashboard.
Scope	FortiSandbox.
Solution	In the FortiSandbox GUI Dashboard, there are 2 different 'total' counts. In a cluster environment, these values may not necessarily match each other because they have different meanings. In the widget 'Scan Performance', 'Total Scanned' (under the column “Scanned”) is for local FSA only. In the widget 'Scan Statistics', 'Total’ is the counter for the entire cluster. For example, in the following cluster with 2 units, the 'Total Scanned' count of the master and slave were 29 and 548. The sum of them roughly matches the 'Total' in 'Scan Statistics' (the small difference in '616' vs '588' was because the captures were not made at the same time). In a cluster, the primary distributes jobs in a round-robin fashion to work nodes. 'Total Scanned' refers to only jobs scanned by the local FSA.