Technical Tip: How to show accessed URLs and resolve hostnames in forward traffic log

Description

This article describes how to show and resolve hostnames in forward traffic log.

By default, the FortiGate will only log the IPs and not resolve them to their corresponding domains, so the URL is not visible in the logs.

For this reason, unknown domain names will be shown in Forward Traffic logs.

Scope

FortiGate.

Solution

To resolve the IP addresses to host names, apply the following settings. To enable the name resolution of the traffic log from the CLI, run the following commands:

conf log setting
    set resolve-ip enable
end

To enable the name resolution of the traffic logs from GUI, go to Log & Report -> Log settings and toggle the Resolve Hostnames option. Starting from v7.2.x, it can be found under Log & Report -> Log Settings -> Global Settings.

Make sure this setting is applied:

conf log gui-display
get
    set resolve-hosts enable 

end