Techical Tip: List users that passed the warning for a FortiGuard webfilter category

Here is a sample of the configuration of a Webfilter profile to warn users while accessing a webpage from the Social Networking category:

Webfilter configuration with action warning

When a user tries to access a website from Social Networking category (e.g. Facebook), the user is presented with the following warning:

Webfilter warning message

When the administrator wants to list users who accessed the websites with the 'Warning' action, the following command will list them (the administrator needs to confirm execution of the command):

fortigate # diagnose webfilter fortiguard override all-warning
Caution: This command is for diagnostic purposes ONLY. It will affect performance of override features.
Do you want to continue? (y/n)y

No  VD    Status  Profile Category ID  Categories         Scope         Expiry Date
1   root  enable  default 37           Social Networking  10.188.5.120  Fri Aug 15 05:17:09 2025

If it is necessary to clear this table, run the following command:

fortigate # diagnose test application ovrd 6
All warning/authentication entries in all vdoms are deleted.

fortigate # diagnose webfilter fortiguard override all-warning
Caution: This command is for diagnostic purposes ONLY. It will affect performance of override features.
Do you want to continue? (y/n)y

No  VD    Status  Profile Category ID  Categories         Scope         Expiry Date

fortigate #

Related articles:

Administrator Guide: FortiGuard filter 

FortiGate CLI Reference: diagnose webfilter fortiguard

Technical Tip: Web Page Blocked using WebFilter when failed to connect to FortiGuard