PCI Report Timeout and Undelivered Email
An online retailer must produce a monthly PCI DSS report from FortiAnalyzer 7.4. The schedule runs on the first day of each month at 02:00, covers the previous 90 days, and contains 14 custom datasets. FortiAnalyzer holds about 600 GB of analytics logs and normally runs at 40% CPU. The report consistently fails after about 2 hours with a report engine timeout, and the scheduled email never arrives. A manual Run Now with a 7-day time range succeeds in 4 minutes. The expected PDF is about 250 MB. The mail server is an internal SMTP relay that requires STARTTLS and authentication; other FortiAnalyzer alerts from the same device are emailed successfully. The auditor wants the report on the third business day, and the security team does not want to add a second reporting appliance.
1. Diagnose the report timeout and propose changes to the datasets and schedule.
Read the worked answer
The 7-day test succeeding while the 90-day schedule fails points to volume and query cost, not a broken schedule. Fourteen datasets each scanning 90 days of 600 GB is expensive; a report timeout is protecting the report engine. Start by optimizing datasets: filter on indexed time and device fields, avoid SELECT *, avoid cross joins, and aggregate only the fields the report needs. Split the monthly report into smaller periods or per-dataset schedules and combine outside FortiAnalyzer, or run a rolling daily report and a monthly summary. Build or verify the report cache or hcache for the historical range if your design uses it, and schedule off-peak. Increase the timeout only after optimization; a longer timeout can still fail and may delay other reports. Test each dataset individually with 90 days to find the worst offender.
2. Why is the scheduled email not delivered when other FortiAnalyzer alerts are received?
Read the worked answer
Because alerts are delivered, the mail server and basic connectivity are working. Check the report schedule's output settings: the recipient list, attachment format, and whether the report is set to email or only save. A 250 MB PDF is likely rejected by the SMTP relay, the recipient mailbox, or an email gateway attachment limit; that rejection may appear only in the relay or FortiAnalyzer event log. Also confirm STARTTLS and authentication are configured on the FortiAnalyzer mail server and that the report job actually completes. If the report times out, no email is sent even if mail is fine. Fix the timeout first, then reduce PDF size or deliver via a secure file share or link. Test with a small report to the same recipients.
3. How should the team validate the report before sending it to the auditor?
Read the worked answer
Validate in layers: compare event counts in the report with equivalent Log View searches for the same time range, device, and ADOM; confirm time zone and daylight saving; check that all 14 datasets returned rows rather than empty sections; run a known test event through and find it in the report. Verify retention covers 90 days and that no ADOM was excluded. Preview the PDF and check page count, charts, and filters. Keep the SQL and a sample of raw logs as evidence. Do not send the auditor a report that has not been reconciled to the log source.