The file name is in the form of xlog.N.log, where x is a letter indicating the log type, and N is a unique number, corresponding to the time the first log entry was received example: ''. When a log file reaches its maximum size configured, FortiAnalyzer rolls the active log file by renaming the file.

System Settings -> Advanced -> Device log settings and roll log file when size exceeds -> Value. The log files ('e.log', 't.log') are rolled as per the configuration done under: These logs in database are known as 'analytic' log. The SQL daemons pick the log that was just saved in the archive, and insert it in the log database. These files on the disk are called the 'archive'. Whenever new logs enter into FortiAnalyzer, the log type is determined from its header, and depending on that it's saved in the respective files on the disk. It is possible to control 'device log file size' and the use of the FortiAnalyzer unit’s disk space by configuring log rolling.

The FortiAnalyzer allows to log system events to disk. This article describes about the log rolling, trimming process and HDD space optimization in FortiAnalyzer.

Rolling process monitor logs