When would you turn off log sync on FortiAnalyzer?

Turning off log sync on FortiAnalyzer is appropriate when you want the device to function as a standby device. In a setup where FortiAnalyzer operates in a high-availability configuration, log synchronization is used to ensure that both primary and standby devices maintain identical logs for redundancy and failover purposes. However, if the standby device's role is strictly for readiness in case the primary fails, log synchronization may not be necessary, allowing it to operate independently without continually syncing logs. This can help conserve resources on the standby device and allows it to be ready to take over operations instantly when required.

Other options present scenarios where log sync would be desired rather than disabled. Increasing log retention time typically requires log sync to ensure uninterrupted logging history across multiple devices. Enhancing the performance of the primary device might involve log management strategies, but disabling log sync is not directly linked to performance improvement. Initiating a manual log backup would also require log sync to be operational to ensure that backups are comprehensive and contain all necessary data.