What are offline logs on FortiAnalyzer?

In FortiAnalyzer, logs are categorized into two primary types for storage: Analytics logs and Archive logs. Analytics logs are indexed in an SQL database for fast querying and reporting, and are often referred to as "online logs". In contrast, Archive logs are the original raw logs stored in a compressed format for long-term retention and compliance. These compressed, non-indexed logs are officially referred to as "offline logs". They are not immediately available for analysis and must be restored to the analytics database if needed for reporting.

B: This option describes analytic logs, also known as online logs, which are indexed and stored in the SQL database for active analysis, the direct opposite of offline logs.

C: This describes a log collection scenario from a device that was temporarily disconnected. While these logs are collected, the term "offline logs" refers to a storage state on FortiAnalyzer, not the status of the source device.

D: Real-time logs that are not yet indexed are in the ingestion and processing queue. This is a transient state before logs are written to either the analytic (online) or archive (offline) storage.

1. FortiAnalyzer 7.4 Administration Guide

"Log View and Log Quota management" section. It states: "Analytics logs are also called online logs

and Archive logs are also called offline logs."

2. FortiAnalyzer 7.4 Administration Guide

"Data management" section. It clarifies: "FortiAnalyzer stores two types of logs: Analytics logs (online) and Archive logs (offline). Analytics logs are indexed in the SQL database... Archive logs are compressed raw logs."

3. FortiAnalyzer 7.4 Administration Guide

"Log Storage" section. This section details the distinction: "FortiAnalyzer saves Analytics logs in a structured SQL database... It saves Archive logs as compressed flat files." This confirms that offline (archive) logs are compressed.