Technical Tip: Understanding the log message 'User Portal Login'
| Description | This article describes the typical circumstances behind the 'Logs login activity for the user portal'. |
| Scope | FortiAuthenticator. |
| Solution | Event ID 50000 refers to a log entry that records any user login activity via the User Portal. It allows administrators to track and review user authentication activities through the User Portal only.
The sample system event message will look like the following:
When login using local user account:
date=2026-02-12 time=15:14:22+0000 oid=8888 logid=50000 cat="Event" subcat="User Portal" level="information" nas="" action="Login" status="Success" msg="User 'test' logged in" user="test"
When login user using remote RADIUS account:
date=2026-02-12 time=15:14:22+0000 oid=8888 logid=50000 cat="Event" subcat="User Portal" level="information" nas="" action="Login" status="Success" msg="Remote user 'test@fortinet.com' logged in" user="test@fortinet.com"
When the user logs in using an Remote LDAP account:
date=2026-02-12 time=15:14:22+0000 oid=8888 logid=50000 cat="Event" subcat="User Portal" level="information" nas="" action="Login" status="Success" msg="Remote LDAP user authentication from 192.168.1.10 with FortiToken successful" user="testtest"
When login user via Single-Sign On (SSO):
date=2026-02-12 time=15:14:22+0000 oid=8888 logid=50000 cat="Event" subcat="User Portal" level="debug" nas="" action="" status="" msg="SSO Start logon session for user "test": 0" user="test"
These logs can be viewed under Log Access -> Logs -> filter '50000'. |
