Artica SIEM for FortiGate: how the figures are computed
How Artica SIEM turns FortiGate logs into traffic figures: interim byte counters, session counting, 10-minute slices and retention.
Back to Artica SIEM for FortiGate
This page explains where each FortiGate figure comes from and how long it is kept. Read it before comparing a SIEM figure with the FortiGate's own counters.
Why it matters
- Summing FortiGate byte counters naively gives wrong totals. Knowing how the SIEM avoids it tells you the totals can be trusted.
- Sessions and log lines are different counts, and each page says which one it shows.
- Retention differs between views, which explains why a 90-day curve can show more history than a 90-day top list.
Byte counters
On a long session, the FortiGate writes an interim log line every few minutes, and each line repeats the bytes sent and received since the session started. Added together, those lines count the same bytes many times: in our lab, a 5.1 GB VPN tunnel showed up as 304 GB a day.
The SIEM keeps the last counters of each open session and stores only the difference. A session's bytes are therefore counted once, however many interim lines it writes.
Sessions
The FortiGate writes one final log line per session, when the session ends. The SIEM counts a session on that line and ignores the interim lines (log IDs ending in 000020). The action is not used for this: a finished UDP or DNS session usually ends with the action accept.
The Logs column of the Policies page is different: it counts every log line, interim lines included.
10-minute slices
All FortiGate figures are summed per 10-minute slice. A slice is written about 10 minutes after it starts, so the most recent traffic appears with that delay. Long periods are shown per hour or per day.
Retention
| Data | Kept | Used by |
|---|---|---|
| Traffic and sessions per tenant and FortiGate | 90 days | General data curves |
| Traffic per client and destination | As long as the client is active; removed with the client after three weeks of silence | Clients, Destinations, General data top lists |
| Traffic per policy | 21 days | Policies |
| Detailed FortiGate logs | A few hours, then summarized | FortiGate status, firewall events |
Which traffic is counted where
- The General data curves and the Policies page count all FortiGate traffic, Internet sources included.
- The Clients and Destinations pages, and the top lists of General data, count only traffic whose source is an internal (private) address.
- A share in a top list is computed against the total of the same population and the same period.
Names and privacy
Names, operating systems and vendors come from the FortiGate's device detection. Control characters are removed when they are stored and when they are displayed; a device once announced a name made of a single invisible character. MAC addresses are shown to administrators and to accounts allowed to see raw data only.