https://help.fortinet.com/fmgr/50hlp/56/5-6-1/FMG FAZ/1100_Storage/0017_Deleted%20device%20logs.htm
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/87802/automatic-deletion

Log Data Sync provides real-time log synchronization to all backup devices. - Log Data Sync in FortiAnalyzer HA setups is designed to ensure that all backup devices in the cluster are kept up-to-date with real-time log data from the primary device. This synchronization helps maintain log integrity and availability even in the event of a primary device failure.
With Initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device. - When a new unit is added to an HA cluster, Initial Logs Sync is crucial to ensure that the new unit starts with a complete set of logs. This process involves the primary device synchronizing its existing logs to the newly added backup unit, which ensures consistency across the cluster.

When in analyzer mode, FortiAnalyzer supports event management and reporting features.
In analyzer mode, FortiAnalyzer provides full support for log analysis, event management, and reporting capabilities.
Analyzer mode is the default operating mode.
By default, FortiAnalyzer operates in analyzer mode, which allows for log analysis and reporting.
The other options are incorrect because:
In collector mode, the FortiAnalyzer primarily stores logs and forwards them to another FortiAnalyzer in analyzer mode, not the other way around.
In collector mode, most disk space is usually allocated to storage rather than analytics, as the logs are primarily stored for forwarding.

RAID 10 combines mirroring (RAID 1) and striping (RAID 0). In a RAID 10 setup with four disks, data is mirrored across two pairs of disks, and those pairs are striped for performance. This results in improved performance and fault tolerance, but the total usable storage is 50% of the total raw storage, meaning four 2 TB disks provide 4 TB of usable space.