Technical Tip: Understanding the log message 'User Portal Logout'

Event ID 50001 refers to an event log entry that records a user portal password logout event. It is not necessarily caused by the user, as it can also be triggered through SSO (Single-sign On).

The system event message will look like the following.

If the user triggers the logout event from the portal:

date=2026-02-11 time=14:23:33+0000 oid=8888 logid=50001 cat="Event" subcat="User Portal" level="information" nas="" action="Logout" status="" msg="User 'test' logged out" user="test"

If the logout event is triggered through SSO:

date=2026-02-11 time=14:23:33+0000 oid=8888 logid=50001 cat="Event" subcat="User Portal" level="debug" nas="" action="" status="" msg="SSO Stop logon session for user "test": 0" user="test"

These logs can be viewed under Log Access -> Logs by filtering for '50001'.

Related articles: 

• FortiAuthenticator self-service portal
• FortiAuthenticator self-service portal and captive portal – purpose and differences