The accuracy of a FortiAnalyzer report depends entirely on the availability of the underlying log data in its database. Two primary system-level reasons can cause expected information to be missing.

First, the logfiled service must process and index incoming raw logs before they can be queried by the reporting engine. If this indexing process is delayed or has not completed for the relevant time period, the data will not be present in the database and, consequently, will be absent from the report.

Second, FortiAnalyzer's data retention policy dictates how long logs are stored. If the logs for the report's time frame have been purged due to exceeding the configured age limit or because the disk space threshold was reached, the data is permanently gone and cannot be included.

A. You enabled auto-cache with extended log filtering.

This is a standard feature for performance optimization. It does not inherently cause data loss unless the filter itself is misconfigured to exclude the expected data.

D. The time frame selected in the report is wrong.

While a common user error, this option points to a configuration mistake. Options B and C describe fundamental system states where the log data itself is unavailable for reporting.

1. FortiAnalyzer Administration Guide 7.4.1

Page 250

"Troubleshooting reports": This section explicitly lists potential causes for empty or incomplete reports

including "The logs were deleted from FortiAnalyzer" (supporting option C) and "The log database is not rebuilt completely" (supporting the concept of option B

where indexing is incomplete).

2. FortiAnalyzer Administration Guide 7.4.1

Page 11

"FortiAnalyzer workflow": This section describes the fundamental process: "Logs are collected from the network devices and indexed in the SQL database." This highlights that if indexing (Option B) has not occurred

the data is not available for reporting.

3. FortiAnalyzer Administration Guide 7.4.1

Page 208

"Configuring log storage policy": This section details the data retention mechanisms

explaining that logs are deleted when the allocated disk space is nearly full or when they are older than the specified time. This directly supports option C as a reason for missing data.