| Event ID 20000 refers to a log entry that records successful authentication events under the Authentication subcategory. It includes all successful authentication attempts regardless of the authentication source, method, or Multi-Factor Authentication (MFA) type used in general except soft FortiToken Mobile. Soft FortiToken Mobile is logged under another event ID.
Sample System Event Messages:
Remote LDAP authentication with no token:
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="REST API" action="Authentication" status="Success" msg="Remote LDAP user authentication with no token successful" user="fortinet/test"
Remote LDAP authentication with SMS token:
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="REST API" action="Authentication" status="Success" msg="Remote LDAP user authentication from (null) with SMS token successful" user="fortinet/test"
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Remote LDAP user authentication with SMS token successful" user="test"
Local or remote authentication with email token:
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Local user authentication from 10.10.10.10 with email token successful" user="test"
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Remote RADIUS user authentication(mschap) with email token successful" user="test"
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Remote SAML user authentication with email token successful" user="fortinet\test@fortinet.com"
Dual token authentication (SMS/email):
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Remote LDAP user authentication with SMS/email dual token successful" user="test"
FortiToken and FIDO authentication (Hardware token):
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Local administrator authentication from 10.10.10.10 with FortiToken and fido token successful" user="test"
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Remote LDAP user authentication from 10.10.10.10 with no token and fido token successful" user="test"
OAuth and Social Login authentication:
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="" status="" msg="Successful OAuth login" user="test"
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="" action="" status="" msg="Successful OAuth token login (XXXX***************XXXX)" user=""
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="user followup authentication" user="SocialLogin_44-google:test"
Windows AD authentication:
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="Authentication" status="Success" msg="Windows AD user authentication from 10.10.10.10 (mschap) with email token successful" user="test"
CLI authentication:
date=2026-03-02 time=10:25:33+0000 oid=8888 logid=20000 cat="Event" subcat="Authentication" level="information" nas="10.10.10.100" action="" status="" msg="CLI authentication attempt for 'admin'. <Result>: Success. <Details>: Credentials verified." user="admin"
These logs can be viewed under: Log Access -> Logs -> Filter '20000'. | 
