Technical Tip: Log IDs for configuration changes made in the FortiGate

Description

This article provides a list of log IDs to check or search for when checking for any configuration changes.

Scope

FortiGate.

Solution

On the GUI, go to Log & Report-> System Events, select the Logs tab, and check if the General System Events is selected as a category of system events.

Add the Log ID column, and search and filter for the following log IDs:

• 32102 - LOG_ID_CHG_CONFIG: General configuration change.
  

• 32103 - LOG_ID_NEW_FIRMWARE: Firmware upgrade or change.
  

• 32104 - LOG_ID_CHG_CONFIG_GUI: Configuration change made via the GUI.
  

• 44544 - LOGID_EVENT_CONFIG_PATH: Configuration path change.
  

• 44545 - LOGID_EVENT_CONFIG_OBJ: Configuration object change.
  

• 44546 - LOGID_EVENT_CONFIG_ATTR: Configuration attribute change.
  

• 44547 - LOGID_EVENT_CONFIG_OBJATTR: Configuration object and attribute change.
  

• 32565 - LOG_ID_RESTORE_CONF_BY_MGMT: Configuration restore initiated by management.
  

• 32566 - LOG_ID_RESTORE_CONF: Configuration restore event.

With the user information included in the column, check whether the admin has made any changes to the configuration.

Refer to the Log Message Reference documentation for more information on the log IDs, which can be found in: FortiGate / FortiOS.

 
Related article:
Technical Tip: Using Automation Stitches to produce a summary of Configuration Changes