Back to Artica SIEM for FortiGate
This page explains where each FortiGate figure comes from and how long it is kept. Read it before comparing a SIEM figure with the FortiGate's own counters.
On a long session, the FortiGate writes an interim log line every few minutes, and each line repeats the bytes sent and received since the session started. Added together, those lines count the same bytes many times: in our lab, a 5.1 GB VPN tunnel showed up as 304 GB a day.
The SIEM keeps the last counters of each open session and stores only the difference. A session's bytes are therefore counted once, however many interim lines it writes.
The FortiGate writes one final log line per session, when the session ends. The SIEM counts a session on that line and ignores the interim lines (log IDs ending in 000020). The action is not used for this: a finished UDP or DNS session usually ends with the action accept.
The Logs column of the Policies page is different: it counts every log line, interim lines included.
All FortiGate figures are summed per 10-minute slice. A slice is written about 10 minutes after it starts, so the most recent traffic appears with that delay. Long periods are shown per hour or per day.
| Data | Kept | Used by |
|---|---|---|
| Traffic and sessions per tenant and FortiGate | 90 days | General data curves |
| Traffic per client and destination | As long as the client is active; removed with the client after three weeks of silence | Clients, Destinations, General data top lists |
| Traffic per policy | 21 days | Policies |
| Detailed FortiGate logs | A few hours, then summarized | FortiGate status, firewall events |
Names, operating systems and vendors come from the FortiGate's device detection. Control characters are removed when they are stored and when they are displayed; a device once announced a name made of a single invisible character. MAC addresses are shown to administrators and to accounts allowed to see raw data only.