Technical Tip: How to check failed admin logins from the GUI and CLI

To check failed admin logins in the GUI, go to Log & Report -> System Events -> General System Events and apply the filter Log Description = Admin login failed.

To check the last failed admin login details, run the following command: 

diagnose debug admin error-log
The recent admin user failed login details:
error code      : -100
method          : https
login name      : administrator
cmdb name       : administrator
login vdom      : root
current vdom    : root
override vdom   : null
login profile   : null
override profile: null
login time      : 2026-02-08 11:13:40

To check failed admin logins from the CLI, run the following command:

diagnose alertconsole list

Or:

diagnose alertconsole list | grep login

It is also possible to create an automation stitch to get alerts for failed admin logins. Go to Security Fabric -> Automation -> Create new, and create an Automation Trigger for the FortiOS Event Log with the 'Admin login failed' event.

Create an Automation Action with Email.

The final automation stitch will look like this:

The same configuration from the CLI:

1. Automation Trigger:

config system automation-trigger

    edit "Login_Failed"

        set event-type event-log

        set logid 32002     <----- Log ID for 32002 corresponds to an event for failed admin login.     

    next

end

2. Automation Action:

config system automation-action

    edit "Login-Failed_Email"

        set action-type email

        set email-to "myemail@example.com"

        set email-subject "FortiGate Admin Login Failed"

    next

end

3. Automation Stitch:

config system automation-stitch

    edit "Admin_Login_Failed"

        set trigger "Login_Failed"

            config actions

                edit 1

                    set action "Login-Failed_Email"

                    set required enable

                next

            end

    next

end

Once a failed login event triggers, the stitch will activate and send an alert message. The email body should look like the following raw logs.

date=2024-07-30 time=09:12:22 eventtime=1722345142416647315 tz="-0400" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="testlogin" ui="https(172.25.181.118)" method="https" srcip=172.25.181.118 dstip=10.9.11.34 action="login" status="failed" reason="name_invalid" msg="Administrator testlogin login failed from https(172.25.181.118) because of invalid user name"

date=2024-07-30 time=09:10:19 eventtime=1722345019384149693 tz="-0400" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="testlogin" ui="ssh(172.25.181.118)" method="ssh" srcip=172.25.181.118 dstip=10.9.11.34 action="login" status="failed" reason="name_invalid" msg="Administrator testlogin login failed from ssh(172.25.181.118) because of invalid user name"

The same document can be used to check and create an automation stitch for successful admin login. Use log-id 32001 (successful admin login) in step 2.

Related articles: