Skip to main content
Nur
Staff
Nur
Staff
June 16, 2026

Technical Tip: FortiAnalyzer Displays IP Address Instead of Username in FortiView VPN SSL and Dial-Up IPsec

  • June 16, 2026
  • 0 replies
  • 45 views

Description

This article describes a scenario where the FortiAnalyzer displays IP addresses instead of usernames in the FortiView VPN SSL and Dial-Up IPsec module.
The system shows internal IP addresses instead of the actual usernames.

d050f189.png

Scope

FortiAnalyzer, FortiGate.

Solution

To resolve the issue of the FortiAnalyzer displaying IP addresses instead of usernames in the FortiView VPN SSL and Dial-Up IPsec module, follow these steps:

  • Verify that the FortiGate is sending the username properly by checking the log view on the FortiGate.
    The 'Source User' column should display the correct username.

diagnose debug application fazsvcd 255 
diagnose debug enable 


[T23439:fazsvc_hdlr_fortiview.c:383] fortiview: cmd=ssl_dialup_ipsec, include 'appcat'='Not.Scanned' apps. 
[T23439:fv_hdlr_sql_query.c:3156] sql=select from ((select f_user, devname, 
_out, coalesce(xauthuser, user, ipstr(remip)) as f_user, (case when s_time=e_time then NULL else max_duration-min_duration end) as durat 
ion, (traffic_in+traffic_out) as bandwidth from (select devname, remip, tunneltype, tunnelid, xauthuser, user, minMerge(s_time_state) as 
s_time, maxMerge(e_time_state) as e_time, minMerge(min_duration_state) as min_duration, maxMerge(max_duration_state) as max_duration, s 
umMerge(traffic_in_state) as traffic_in, sumMerge(traffic_out_state) as traffic_out from (SELECT from (SELECT t1., t1.timescale as it 
ime, t2.devid as devid, t2.vd, t2.devname, t2.csf, t2.devgrps FROM (SELECT FROM ($fablog_mv_e_ipsec) t WHERE ((1=1)) ) t1 INNER JOIN d 
evtable_ext t2 ON t1.dvid=t2.dvid) t WHERE $filter AND $filter-drilldown) t where vpntype=0 group by devname, remip, tunneltype, tunneli 
d, xauthuser, user ) t where tunneltype!='ssl-web' or bandwidth>0 /FabricOrderBy bandwidth DESC ### devname OrderByEND*/)/*fabricEnd*/ 
t group by f_user, devname order by bandwidth desc limit 100 )) t limit 1000000


  • If the FortiGate sends the Source IP (raw logs) as a Hostname, the FortiAnalyzer will display the User as a Hostname.
    Otherwise the FortiAnalyzer will show the user as an IP Address.

  • If the issue persists, rebuild the FortiAnalyzer database using the following CLI commands:

execute sql-local rebuild-db
diagnose sql status migrate-db > to check progress

Terms & ConditionsAccessibility statement