FortiManager Firmware : Special notices : Log arrays
 
Log arrays
After creating a log array, only new logs will be populated into this array. Older logs will remain on the device. To collect older logs, you will need to build the array database. Use the following CLI command to build the array database:
execute sql-local rebuild-device <log array device ID>
The SQL logs for the members of the log array will be rebuilt. To verify that the array rebuild was successful, select the Log View tab to view the log array and logs.
 
Executing this command will not reboot the FortiManager device.
 
Fortinet recommends configuring log arrays prior to deploying the FortiManager into production. When adding and deleting log arrays, you will need to rebuild the database to view older logs.