How does log forwarding work for devices in an HA cluster?

In a High Availability (HA) cluster, the log forwarding mechanism is designed to ensure that logs are efficiently sent to the FortiAnalyzer (FAZ) for analysis and storage. The primary unit in the HA cluster is the one responsible for centralized management tasks, which includes logging activities. It acts as the main point of contact for external devices, such as the FortiAnalyzer.

Only the primary unit forwards logs to the FAZ. This configuration prevents potential conflicts or duplicate log entries that could occur if both primary and secondary units attempted to log simultaneously. By centralizing the log forwarding process through the primary unit, the system maintains organized and consistent log management, providing a clearer and more manageable overview of the network's activity.

The secondary unit, while it can process traffic and maintain network operations, does not directly interact with the FAZ for logging purposes. This design helps avoid the complication of managing log records from multiple units and ensures that the logs are reliable and coherent as they are directed to the FortiAnalyzer.