Technical Tip: Filtering for security event logs on FortiOS version 7.2

Description

This article describes that on older FortiOS versions, in security events log filters on FortiGate, user used to be able to set different filters on each type of event log, like anomaly vs traffic vs IPS vs web filter, FortiGate GUI would remember the log filter settings for each of them.

Scope

FortiGate.

Solution

Since version 7.2, regardless of which filter is in place on the Forward traffic Log, FortiGate will apply this filter to all the Security Events logs, and will not allow to save different filters on each event log if there is a filter in forward traffic log already.

See the feature enhance note here: Changes in GUI behavior.

See the following example:

Filter applied to the forward log:

The same filter is automatically applied to the security event log, as seen below:

At this point, if another filter is applied in the security event log, it will be reverted back to the forward log filter applied  after refreshing the page or switch between security event log.

Note: Versions 5.0 to 7.2 are outside of engineering support. These commands may differ in higher versions. Consider upgrading the firmware level on the device to a supported version (7.4 up to 7.6). Check the firmware path and compatibility depending on the hardware on the following link: Upgrade Path Tool.