Technical Tip: How to disable the logs of web-filter license expired
Description
This article describes how to disable the logs related to the web-filter license expiring, due to a big amount of logs of this type when the license is going to expire or has expired.
Scope
FortiOS.
Solution
The following critical firewall event was detected: 'FortiGuard web filter license expired'.
date=2026-03-17 time=03:27:57 devname=FW-Host014 devid=FGxxxxxxxxxxxxxx eventtime=1773736077164682072 tz="-0500" logid="0100020109" type="event" subtype="system" level="critical" vd="root" logdesc="FortiGuard web filter license expired" msg="FortiGuard Web Filter license is expired."
Depending on the logs storage (memory, disk, syslog), run the following commands in the CLI:
config log syslogd filter
config free-style
edit 1
set category event
set filter "(logid 0100020109)"
set filter-type exclude
next
end
config log memory filter
config free-style
edit 1
set category event
set filter "(logid 0100020109)"
set filter-type exclude
next
end
The ID 0100020109 is related to the Web-filter License logs.
Related articles:
Technical Tip: Configuring advanced syslog free-style filters