Technical Tip: How to configure logging to memory in FortiOS
Description
This article describes how to configure logging to memory in FortiOS. Logging can be enabled by using either the GUI or the CLI. Both of them have been changed from previous releases. The configuration of logging in earlier releases is described in the related KB article below.
Notes:
- Logging to memory is not recommended for other purposes than troubleshooting.
Repeated read/write operations like overwriting the logs will shorten the life of the memory chip. - In units with available hardware disk, logging to memory can only be enabled through the CLI (not available in GUI).
Scope
FortiGate.
Solution
From WebGUI:
- Log into FortiGate.
- Go to Log & Report -> Log Settings menu (if Virtual Domain is Enabled, set it under each VDOM).
- Refer to Local Log -> enable Memory.
- Select Apply.
In a FortiGate with a Disk, only the 'Disk logging' option is available under Local Logs settings and Memory logs can only enabled through the CLI.
Enable log memory via CLI:
Execute per VDOM.
config log memory setting
set status enable
end
Set the Log level via CLI:
config log memory filter
set severity information
set forward-traffic [enable/disable]
set local-traffic [enable/disable]
set multicast-traffic [enable/disable]
set sniffer-traffic [enable/disable]
set ztna-traffic [enable/disable]
set anomaly [enable/disable]
set voip [enable/disable]
end
Related articles:
Technical Tip: How to configure logging to memory in FortiOS v5.0
Technical Tip: How to check/filter configuration changes logs
Technical Tip: How to perform a syslog and log test on a FortiGate with the 'diagnose log test' command