Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

Log fetching on FortiAnalyzer is a mechanism designed for historical data analysis. It allows a FortiAnalyzer client to retrieve archived logs from a FortiAnalyzer server. This process enables administrators to run queries and generate reports on historical log data that might be stored on a different device. For this feature to function correctly and ensure compatibility, it is a strict requirement that both the client and server FortiAnalyzer devices are the same model and are running the exact same firmware version.

A: A FortiAnalyzer is configured as either a client or a server for a specific log fetching task with a peer; it cannot perform both roles simultaneously with the same device.

C: The primary purpose of log fetching is to retrieve archived logs for historical analysis, not to provide redundancy for real-time or analytics logs. Log forwarding is used for redundancy.

FortiAnalyzer Administration Guide 7.4

Page 218

"Log fetching" section.

"Log fetching is used to retrieve archived logs from one FortiAnalyzer device and send them to another FortiAnalyzer device. This allows you to run queries and reports against historical data." (Supports option D)

"For log fetching to work

both FortiAnalyzer devices must be the same model and be running the same firmware version." (Supports option B)

"One FortiAnalyzer device is configured as a fetch client

and the other is configured as a fetch server." (Contradicts option A)

The description of retrieving "archived logs" for "historical data" analysis contradicts the idea of fetching "analytics logs" for "redundancy". (Contradicts option C)