Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)
Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)
Log fetching on FortiAnalyzer allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another, ensuring historical data can be effectively utilized. Additionally, a FortiAnalyzer device can perform either the fetch server or client role, and it can indeed perform two roles at the same time but with different FortiAnalyzer devices at the other end, not the same device.
Correct answer is B & D https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/651442/log-fetching
A FortiAnalyzer device can be either the fetch server or the fetching client, and it can perform both roles at the same time with DIFFERENT FortiAnalyzer devices. (not same devices). So i think C incorrect
Correct answer is A & B https://docs.fortinet.com/document/fortianalyzer/6.2.0/cookbook/366512/fetching-logs-from-one-fortianalyzer-to-another
A is wrong because Log fetching don't fetch ANALYTICS logs, instead archived logs. B is wrong because Log fetching don't query reports nor analytics logs. According the article https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/651442/log-fetching and FortiAnalyzer Analyst Study Guide for FortiAnalyzer 7.2, p. 77-78, C and D are correct.
C is incorrect: "A FortiAnalyzer device can be either the fetch server or the fetching client, and it can perform both roles at the same time with different FortiAnalyzer devices." Choice C states *same* devices at other end.
FortiAnalyzer Analyst Study Guide for FortiAnalyzer 7.2, p. 77-78