Fortinet NSE 5 - FortiAnalyzer 6.2

The total quota is less than the total system storage because some space is reserved for system use. This is evident from the 'Reserved space: 15.0GB (19.0% of total space)' line in the exhibit, which indicates that a portion of the total system storage is set aside for system-specific functions, reducing the amount available for user quotas.

Using the command 'set log checksum' has two primary purposes. First, it helps protect against man-in-the-middle attacks during the log upload from FortiAnalyzer to an SFTP server by ensuring the integrity of the logs during transmission. Second, it prevents log modification or tampering by providing a way to validate the authenticity and integrity of the log files, ensuring that logs have not been altered.

At 14:55, the data point indicates that the receive rate of logs (blue line) is higher than the insert rate of logs (orange line). This means that raw logs are reaching FortiAnalyzer faster than they can be indexed. When the receive rate exceeds the insert rate, it results in a backlog of unprocessed logs, but it does not necessarily mean that logs are being dropped. If logs were being dropped, it would indicate a failure to manage incoming data, which is not explicitly shown in the graph.

When dealing with software RAID on a FortiAnalyzer, it is necessary to shut down the device before replacing a hard disk. Software RAID configurations do not support hot swapping, meaning the system must be powered down to safely replace the disk without risking data corruption or loss.