In the event of a WAN link failure between the collector and the supervisor, by...

When aWAN link failureoccurs between thecollectorand thesupervisorin FortiSIEM, the collectorbuffers event filesuntil the connection is restored. By default:

● Thecollector can store up to 10,000 event filesbefore reaching its buffer limit.

● Once the WAN link is restored, thecollector uploads the stored event filesto the supervisor for processing.

● If thebuffer limit is exceeded,older event files may be overwrittento make space for new ones.