No. LogArşiv runs entirely on-premise, on your own server. It opens no outbound connection of its own and needs no internet access to work. The records never leave the building.

The default retention period is 730 days and it is configurable. The last three days are searched from the database, everything earlier from sealed archive files; the two merge into a single result list for you.

No. If free space drops below the threshold you set (5% by default), writing stops and a warning appears in the dashboard. Records are never dropped silently; you see what happened and either grow the disk or shorten the retention period.

The seal digests each day’s records with SHA-256 and chains them to the previous day, which makes any retroactive change detectable. Define a timestamp server and each seal is additionally dated by an independent authority. Whether that counts as evidence is of course for a court to weigh; what LogArşiv does is keep the record in a state where you can demonstrate technically that it has not changed.

Half a day if the server is ready. One syslog target is defined on the FortiGate; the device is not restarted and traffic is not interrupted. On the Business and Public sector plans we do the install for you.

Yes. Historic records in syslog format can be imported and are sealed for the day they belong to.

The fields in the interface are built around the FortiGate log format, so that is where it performs best. Other devices sending standard syslog are still collected and archived, but field-level search is limited.