FAZ-800F FortiAnalyzer Security Log Analytics Appliance

A dedicated FortiAnalyzer logging appliance

FAZ-800F is Fortinet's physical FortiAnalyzer appliance for centralized security log collection, analytics and reporting. The exact manufacturer order describes four GE interfaces, two SFP interfaces, 16 TB of storage and a log-volume profile up to 300 GB per day. It is not a FortiGate 100E firewall and should not be selected by firewall, IPS or VPN throughput.

The hardware specification identifies a 1 RU rackmount appliance. Keep this chassis order separate from FortiAnalyzer VM licensing and from any support or security subscription on the quotation. Confirm the offered appliance, included disks, rack accessories, condition and entitlement registration before purchasing.

Use analytics and collector rates for different workloads

Fortinet publishes an analytic sustained rate of 8,250 logs per second for FAZ-800F and a collector sustained rate of 12,000 logs per second. These describe different operating workloads. The collector figure is a separate metric rather than the sustained analytic rate; the table does not promise a combined rate obtained by adding the two rows. The separate daily log-volume row is 300 GB per day. Match the deployment role, event rate and actual log volume independently.

The sustained-rate footnote defines the metric as the maximum constant log-message rate the platform can maintain for at least 48 hours without SQL database or system-performance degradation. This is a qualified manufacturer sizing figure, not an unconditional guarantee for every log mix, storage layout or concurrent workload.

Plan device scale and retention together

The model column lists a maximum of 800 devices/VDOMs and an analytics-days figure of 30. Those are capacity-planning dimensions, not a license term or a promise that every collection pattern will retain exactly thirty days.

The retention footnote assumes logs arrive continuously at the sustained analytics rate; a lower average rate can increase the number of analytics days. Establish the actual daily volume, device/VDOM inventory, peak ingestion, analysis requirements and retention policy before choosing disk capacity.

Distinguish installed disk capacity from usable RAID space

The FAZ-800F table gives 16 TB total storage as four 4 TB drives, while usable storage after RAID is listed as 8 TB. RAID 10 is the published default. Comparing the total disk figure directly with a usable-retention requirement would overstate the capacity available under that default configuration.

The supported RAID levels are 0, 1, 5 and 10. The manufacturer identifies removable drives and hardware/hot-swappable RAID. Any offered replacement disks or changes to the published RAID configuration need their own compatibility and usable-capacity review; this page does not promise that all RAID modes provide the same resilience or storage space.

Check interfaces, rack space and power

The manufacturer lists four GE and two SFP interfaces for the 1 RU chassis. Confirm the network connection plan and any separately supplied optical modules rather than treating the SFP positions as included optics or firewall service ports.

The physical dimensions are 1.75 by 17.44 by 22.16 inches, with a listed weight of 28.6 lb (13.0 kg). Check rack depth, cable access and the actual supplied mounting accessories against those dimensions.

The AC input range is 100-240 VAC at 50-60 Hz. Average and maximum published power consumption are 108 W and 186 W. The FAZ-800F column explicitly says there are no redundant hot-swap power supplies. Do not transfer the redundant-PSU checkmark from the neighboring FAZ-1000E or FAZ-2000E columns to this model.

Support and software are separate procurement checks

The table identifies FortiGuard Indicator of Compromise capability, while the ordering section describes an IOC subscription as a separate service offering. Confirm the applicable service order, FortiCare coverage, software release and account entitlement for the offered appliance. A platform feature checkmark does not prove an active subscription, and the bare FAZ-800F order code does not state a one-, three- or five-year contract.

Use the exact model's hardware documentation and the release-specific compatibility/upgrade guidance when planning managed-device support. A historical hardware data sheet does not establish present lifecycle dates or support for every software version. Obtain those facts for the actual release and contract rather than borrowing them from a newer FortiAnalyzer model.

Prepare a logging-specific quotation

Provide the exact FAZ-800F code, device/VDOM count, daily log volume, peak event rate, analytics or collector role, retention target, disk/RAID requirements and planned software release. Have the offered configuration, accessories, condition, support scope, availability and delivery arrangements confirmed on the quotation.

The displayed image is an official Fortinet brand reference. It is not a photograph of the offered FAZ-800F unit and does not establish its installed disks, accessories, packaging or condition.

FAZ-800F purchase questions

Is 16 TB the usable capacity at the default RAID setting?

No. Fortinet lists 16 TB installed capacity, 8 TB usable after RAID and RAID 10 as the default. Check the offered disk/RAID configuration.

Does 12,000 logs per second mean the analytics rate?

No. That is the collector sustained-rate row. The analytic row is 8,250 logs per second, with the manufacturer's constant-rate qualification.

Are redundant hot-swap power supplies listed for this model?

No. The FAZ-800F column explicitly marks that feature as absent. A neighboring model's power configuration must not be applied to it.

Document/Firmware Download

• Fortinet FortiAnalyzer manufacturer data sheet: FAZ-800F English specification column, sizing footnotes and exact order row within the Korean edition