The analyzer mode is the default mode that supports all FortiAnalyzer features. If your network log volume does not compromise the performance of your FortiAnalyzer unit, you can choose this mode.

Figure 6 illustrates the network topology of the FortiAnalyzer unit in analyzer mode.