To resolve IP addresses without impacting FortiAnalyzer's performance, the resolution task must be offloaded to the source FortiGate devices. By enabling IP resolution on each FortiGate, the device performs the DNS lookups and embeds the resulting hostnames directly into the log data before sending it to FortiAnalyzer. FortiAnalyzer then simply ingests and displays the already-resolved names, avoiding the resource-intensive process of performing thousands of DNS queries itself. This method directly satisfies the critical requirement of preventing any additional performance load on the FortiAnalyzer.

A: Resolving on a per-ADOM basis still consumes FortiAnalyzer CPU and memory for DNS lookups, thereby impacting its performance, which the question explicitly forbids.

B: This command enables IP resolution on the FortiAnalyzer for FortiView, which is the direct cause of the performance impact that needs to be avoided.

C: Configuring local DNS servers is a prerequisite for resolution by FortiAnalyzer, but the resolution process itself still consumes FortiAnalyzer resources and causes a performance hit.

1. FortiAnalyzer Administration Guide 7.4.1

Page 211

Section: "System Settings > Advanced > Display Options". The guide notes for the "Resolve unknown IPs using DNS lookup" setting: "Enabling this option may impact system performance." This confirms that resolution on FortiAnalyzer has a performance cost.

2. FortiAnalyzer Administration Guide 7.4.1

Page 101

Section: "Device Manager > Performance > Log Insert Lag Time". The guide states: "To improve FortiAnalyzer performance

you can configure FortiGate to resolve IP addresses in logs. This can reduce the load on FortiAnalyzer." This directly supports offloading the task to FortiGate.

3. FortiOS CLI Reference 7.4.1

Page 1381

Command: config log fortianalyzer setting. The set resolve-ip {enable | disable} option is described as enabling/disabling resolving IP addresses to hostnames in logs sent to FortiAnalyzer

confirming this capability exists on the FortiGate.