Fortinet FortiAnalyzer VM

FortiAnalyzer as a virtual appliance, licensed by GB/day of logs from a 1 GB base upward, with stackable upgrades on VMware, Hyper-V and the major clouds.

Logging, analytics and reporting for the Security Fabric

FortiAnalyzer is the logging, analytics and reporting half of Fortinet’s management story: FortiGate, FortiSwitch, FortiAP and FortiClient send their logs to it, and it turns them into correlated events, reports and the evidence trail an audit needs. It is also what several other Fortinet services depend on — the FortiClient forensics and SOCaaS subscriptions, for instance, state that a FortiAnalyzer is required and not included.

Licensed by log volume, not by box

The virtual appliance is licensed by how much it ingests rather than by a hardware model. A base licence covers 1 GB/day; upgrade licences add 1, 5, 25 or 100 GB/day and stack onto the existing deployment, so capacity is bought as the estate grows rather than in a single step. Device quota — the storage reserved per managed device — rises with the tier alongside the sessions-per-day ceiling.

Sizing the host

vCPU support runs from one to unlimited and memory from 1 GB to unlimited, so the licence tier rather than the licence type is what bounds the deployment. Network interface support is 1 to 4. The practical constraint is disk: log retention is a function of GB/day and how long you keep it, so size the volume against the retention window the business actually needs rather than the default.