Technical Tip: Logging FortiGate administrative SSH sessions from Linux/MacOS endpoints

1. To connect to FortiGate as an SSH server while also logging output to a file, open a Linux or MacOS command line interface such as the 'Terminal' application.

2. Connect to the FortiGate using the 'ssh' command and pipe the output to the 'tee' command:
   
   ssh -l <administrator name> <FortiGate domain name or IP address> | tee <log file name>
   
   

By default, the tee command will overwrite the filename given. To append instead, use '-a' as below.

ssh -l admin 10.21.8.9 | tee -a ssh_session.log

Once created, the log file is readable using a text editor or the 'cat' command.

For serial console connections, one option is the 'screen' command with 'L' to enable logging. The serial console driver and device must already exist. 

fortinet@demo:~$ sudo dmesg | grep tty
[sudo] password for fortinet:
[ 0.194449] printk: legacy console [tty0] enabled
[ 1.282010] 00:00: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
fortinet@demo:~$ screen -L /dev/ttyS0 9600

For Windows endpoints, Putty is a commonly used terminal emulator and SSH client application for Windows devices.

It can be used to collect a long-running diagnostic from a Fortinet device when an HTTPS diagnostic is not suitable.

It also supports serial console connections.

Related article:

Technical Tip: How to create a log file of a session using PuTTY