Technical Tip: How to download logs from FortiGate GUI
Description
This article describes how to download Logs from the FortiGate GUI.
Scope
FortiGate.
Solution
Logs can be downloaded in text form from the GUI by following the steps below:
After logging in to the GUI, go to Log & Report ->Select the required log category, for example 'General System Events' or 'Forward Traffic', and log location. For example: 'Disk'.
Select the download icon (on the top left of the page).
The log file will be downloaded to the 'Downloads' folder of the browser.
Note:
If a specific line of log is needed, select the required log row (for multiple rows, press the ‘Ctrl’ key on the keyboard and then select the required log row) and then select the download icon.
Also, make sure the pop-up blocker or browser download settings are not blocking the download.
System event:
v7.0:
 
 
v7.2 and v7.4:
 
Select from the drop-down to download or view:
The downloaded file name will be in the format of log source-type-subtype-date.log. For example, forward traffic logs downloaded from FortiAnalyzer will be 'fortianalyzer-traffic-forward-2025_01_01.log'.
All the logs will be downloaded in a text file. The same logs can be downloaded in CSV and JSON formats.
In FortiGate v7.4+, v7.6.3 and below, it is possible to export logs in CSV/JSON format directly from the FortiGate itself. Starting FortiOS 7.6.4, the design has been changed, where the export button will no longer be available: Technical Tip: Exporting logs in CSV or JSON format directly from the FortiGate.
After selecting the formats, the required number of entries can be downloaded.
v7.6+:
In FortiGate version 7.6 and above, when the download icon is clicked, a Download Logs window pops up instead of exporting directly from the log table.
Two options are available: Download and combine (Recommended) for very large files, which are more than 50,000 logs based on the selected time period and filters, and Download as a single file for smaller log volumes.
Download and combine option downloads logs in multiple time-based files and combines them into a single file if possible. If the range is not specified for the logs, then the time period will be set to the current date and 7 days prior.
Allow the browser prompt to allow multiple file downloads to complete the process successfully.
Notes:
- By design, all of the logs can be viewed based on the filters applied. This does not mean that it allows a whole set of logs based on the filter to be downloaded, as it will only allow a small set of logs. To download the whole log file based on the filter, it is required to export all of the logs via an FTP or TFTP server.
- There is a hard-limit of 400,000 log entries that can be downloaded.
Workaround:
To download the raw log file in its entirety when exceeding the hard-limit, use the following CLI commands:
execute backup disk alllogs ftp <FTP server>[:port] <FTP username> <password>
execute backup disk alllogs tftp <TFTP server>[:port]
execute backup memory alllogs ftp <FTP server>[:port] <FTP username> <password>
execute backup memory alllogs tftp <TFTP server>[:port]
Note:
There is no option to specify the source IP or interface to backup the log; In other words, the option is not available currently.
Related articles:
Technical Tip: Download Debug Logs and 'execute tac report'
Technical Tip: How to configure logging in memory in later FortiOS
Technical Tip: How to check/filter configuration changes logs
Technical Tip: How to download disk logs in plaintext format avoid performing LZ4 decompression usin...
Technical Tip: Standard procedure to format a FortiGate Log Disk, log backup from disk
Technical Tip: How to configure syslog on FortiGate