I'll add my voice to the Big White Book being a superior companion book, at least in terms of adding content. There is a ton of stuff about the Age of Legends, the Forsaken, and other things that is really interesting. It only covers things mentioned in the story up to around Lord of Chaos though.

Thanks Afroman! I have added the secondary domain controller to the config via the CLI - was not aware of this option/syntax.

Any word on the timing of 5.4.1 ?

Even 100,000 per day would double the population of the entire country in 8 years.

Hundreds of thousands every day ?

Looks like this did the trick, thanks Afroman!

Not that BE has ever been stellar, but the UI/display changes they made for all of the editions beginning with BE 2012 and on completely baffled us. Talk about making a complicated product truly incomprehensible.

Update: Things APPEAR to be working now, though I still get some old entries from the other firewalls, but no new ones. Maybe it's from when the FA was first being stood up last week.

The date range function doesn't seem to work still though; putting in any date/time range always shows ALL entries.

I'll see how it works going forward.

They're all 5.2.x

Hi Afroman- I had played with this very setting (matching the device ID), but no matter what I put in that field (even a bogus serial number) it still shows all of the VPN logins for all three of the devices attached to this FortiAnalyzer.... I don't get it.

The firewall I'm trying to pull data from is a 100D in a HA cluster with another 100D - I've tried both serial numbers. Is the HA config potentially a problem? The FA discovered the HA cluster with no issues and it shows the cluster name in the device manager.

The filter in the report just doesn't seem to actually filter to the specific device, I keep getting logon entries from other devices, even though the report setup clearly shows only the one firewall.

I don't believe the time is synced (I can check this) but it wouldn't be off by multiple days since they're both getting NTP from Fortinet right?

This is an example of what I'm seeing. Even though there is only one device selected in my test dataset, the bottom six entries in the test output are from a different firewall.

Additionally, you can see that the time period is set to 2 hours, yet the test output shows data older than two hours.

Any ideas?

Afroman- Sorry, I accidentally deleted my first thread. I saw your reply though.

We are running 5.2.5

I will check out your link about custom views, thanks!

Thanks, I will check this out. Sounds like we're getting a FortiAnalyzer VM for free from FortiNet

The cold tends to not be as bad along the coast lines (regularly 5-10 degrees warmer than inland), so if you can afford to live in Narragansett or nearby, that might be an option. There's also Rock Spot climbing gym in South Kingstown which has a very enthusiastic young crowd (my wife is very active there). They have a location in Lincoln as well.

I got a notice last night as well. I had forgotten about it !

5: Russia with virtually unassailable mountain ranges protecting most venues of approach, with the Great Wall to boot