When does FortiAnalyzer enter the real-time log sync state?

FortiAnalyzer enters the real-time log sync state after the initial log sync has been completed. This state is essential for ensuring that logs are synchronized in real-time between FortiAnalyzer and the connected devices. Once the initial synchronization of logs is done, FortiAnalyzer can continuously receive and process logs from the devices in real-time, allowing for more timely monitoring and analysis.

Understanding when the real-time log sync occurs is crucial for proper log management and for ensuring that the logs reflect the most current information from the network devices. It indicates that after the foundational syncing is out of the way, the system is ready to maintain ongoing communication and log collection.

Other scenarios, such as rebooting a device or configuring High Availability (HA) settings, do not directly trigger the transition to the real-time log sync state, but rather relate to the overall operational state and management of devices connected to FortiAnalyzer.