Technical Tip: Log files exported from FortiGate GUI displays last 24 hours of log data instead of full 7 day range

Description

This article addresses an issue where FortiGate exports only the last 24 Hours of Log Data from GUI, even though the log duration is set to 7 days.

Scope

FortiGate v7.2.8, v7.4.1, v7.6.0.

Solution

When filtering Forward Traffic Logs by selecting the duration 'last 7 days' with the 'Disk' storage setting in the GUI, the logs are displayed correctly for the entire 7-day period. However, upon downloading the logs, the generated text file contains only logs from the last 24 hours.
 

This issue has been resolved in:

• v7.6.4 (available to download from the Fortinet Support portal).

• v8.0.0 (available to download from the Fortinet Support portal).

As a workaround, export logs via an FTP or TFTP server:

execute backup disk alllogs ftp <FTP server>[:port] <FTP username> <password>
execute backup disk alllogs tftp <TFTP server>[:port]

execute backup memory alllogs ftp <FTP server>[:port] <FTP username> <password>
execute backup memory alllogs tftp <TFTP server>[:port]

Related article:

Technical Tip: How to download disk logs in plaintext format avoid performing LZ4 decompression using CLI