This article assumes that a DLP security profile has already been configured and applied to a proxy-based firewall policy. For information on connecting FortiGate and FortiData see: Connecting FortiData to FortiGate/Administration Guide. For information on configuring FortiData labels in a DLP profile see: FortiData labels/Administration Guide. DLP is handled by the scanunit process, use the following CLI commands to run a scanunit debug filtering for DLP.
diagnose debug console timestamp enable
diagnose sys scanunit debug dlp
diagnose sys scanunit debug level verbose
diagnose debug enable
To disable the debugging:
diagnose debug disable
diagnose debug reset
In this example output, the file being scanned is named 'helloworld.py' and should match the configured customer FortiData label 'source-code'. The DLP profile was configured for the action block.
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: start archive level 0 scan 'helloworld.py'
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: scanning file 'helloworld.py' type 96 len 785 buffer-type none decoded 0 archive_is_blocked 0 checking 1 of 1 rules
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: Matching rule 0
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: Match filename 'helloworld.py'.
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: file_scan no match found.
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: done archive level 0 scan 'helloworld.py' result 0
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: start archive level 0 scan 'helloworld.py'
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: scanning file 'helloworld.py' type 96 len 785 buffer-type none decoded 0 archive_is_blocked 0 checking 1 of 1 rules
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: Matching rule 0
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: Match filename 'helloworld.py'.
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: file_scan no match found.
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: done archive level 0 scan 'helloworld.py' result 0
2026-06-04 15:23:33 sw 0/26920 job 195 fortidata label "source-code" name 'helloworld.py' (0)
2026-06-04 15:23:33 sw 0/26920 job 195 matched dlp rule 1 act 2 filename 'helloworld.py' fortidata label 'source-code' (0)
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: Taking action 0x2, filter ID 1
In the example output, the significant lines are as follows:
2026-06-04 15:23:33 sw 0/26920 job 195 fortidata label "source-code" name 'helloworld.py' (0)
2026-06-04 15:23:33 sw 0/26920 job 195 matched dlp rule 1 act 2 filename 'helloworld.py' fortidata label 'source-code' (0)
2026-06-04 15:23:33 sw 0/26920 job 195 DLP: Taking action 0x2, filter ID 1
In this case, the file was matched against the custom FortiData label 'source-code' and the file transfer was blocked, as indicated by 'DLP: Taking action 0x2'.
For reference to the DLP actions:
DLP: Taking action 0x1 - monitor DLP: Taking action 0x2 - block DLP: Taking action 0x8 - quarantine IP
Related articles:
| 
