Technical Tip: Traffic logs displaying the 'Source Name' and 'Destination Name' with IP addresses
Description
The FortiGate does not resolve the IP addresses to hostnames for the traffic logs by default. To resolve the IP addresses to hostnames, this must be set in the CLI. More processing will be required to resolve hostnames, and a valid DNS setting is necessary.
Scope
FortiGate.
Solution
To enable the name resolution of the traffic log from the CLI:
config log trafficfilter
set resolve enable
end
Example logs:
date=2020-07-22 time=09:34:21 eventtime=1721646861345871234 tz="-0700" logid="0000000098" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.2.50.23 srcname="test.name.src" srcport=49211 srcintf="dmz" srcintfrole="undefined" dstip=172.18.200.45 dstname="obc.fortinet.com" dstport=53 dstintf="wan1" dstintfrole="undefined" srccountry="Reserved" dstcountry="Reserved" sessionid=742 proto=17 action="accept" policyid=3 policytype="policy" poluuid="b1c230e2-a914-44cc-91d2-ff92c3e712ab" policyname="A-out" service="DNS" trandisp="snat" transip=172.18.10.1 transport=49211 duration=143 sentbyte=312 rcvdbyte=128 sentpkt=5 rcvdpkt=2
...
Additional note:
On newer versions of the FortiOS, including branches v7.2, v7.4, and v7.6, this option does not exist anymore. To enable the IP resolution on these versions, the following can be executed:
config log setting
set resolve-ip enable <----- Disabled by default.
......
end
Related documents:
