Operation modes
The FortiAnalyzer unit has three operation modes:
• Standalone - The default mode that supports all FortiAnalyzer features.
• Analyzer - The mode used for aggregating logs from one or more log collectors. In this mode, the log aggregation configuration function is disabled.
• Collector - The mode used for saving and uploading logs. For example, instead of writing logs into the database, the collector can retain the logs in original (binary) format for uploading. In this mode, the report function and some functions under System and Tools are disabled.
The analyzer and collector modes are used together to increase the analyzer’s performance. The collector provides a buffer to the analyzer by off-loading the log receiving task from the analyzer. Since log collection from the connected devices is the dedicated task of the collector, its log receiving rate and speed are maximized.
| The FortiAnalyzer 100 and 400 models do not support the analyzer mode. |
The mode of operation that you choose will depend on your network topology and individual requirements. For information on how to select an operation mode, see
“Changing the operation mode”.