Troubleshooting Tip: Syslog server is not displaying the Admin Login and Logout Event from FortiGate
| Description | This article explains why syslog server may not show admin login and logout events despite displaying other event logs. |
| Scope | FortiGate. |
| Solution | It is possible that the Syslog server may not display administrator login and logout events from FortiGate, but it shows other events, such as DHCP, SSLVP, WiFi Authentication and Performance log, etc.
Example:
The following log is displayed in the syslog:
Feb 6 12:01:01 10.48.0.1 date=2026-02-06 time=12:01:01 devname="FortiGate-Primary" devid="XXXXXXXXXXXXXXXX" eventtime=1770397261263439389 tz="-0500" logid="0104043664" type="event" subtype="wireless" level="notice" vd="root" logdesc="DHCP server sent DHCP OFFER" sn="XXXXXXXXXXXX" ap="FP07" vap="Fortinet" ssid="Fortinet" stamac="XX:XX:XX:XX:XX:XX" server="10.48.4.5" security="WPA2 Personal" encryption="AES" action="DHCP-OFFER" reason="N/A" msg="DHCP OFFER of IP 10.48.3.74 from server 10.48.4.5 with MAC XX:XX:XX:XX:XX:XX for client XX:XX:XX:XX:XX:XX from router 10.48.3.1 on subnet 255.255.255.0 with dns 10.48.4.5, 192.168.1.5, 10.253.3.5" snprev="XXXXXXXXXXXX" remotewtptime="2134.684899"
The following log is not displayed in the syslog:
date=2025-03-21 time=00:41:47 eventtime=1742542907554349462 tz="-0700" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="XXXXXXXXXXXX" user="admin" ui="https(10.32.98.8)" method="https" srcip=10.32.98.8 dstip=10.40.19.6 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from https(10.32.98.8)"
This may be due to the syslog log filter configuration in the FortiGate. If the Syslog filter is set to 'notice', only logs at the 'notice' level or higher will be forwarded to the Syslog server. Since the admin login and logout events are of type 'information', which has a log level lower than 'notice', they will not be forwarded by the FortiGate.
To solve this problem, set the syslog log severity level in FortiGate to 'informaiton'.
config log syslogd filter set severity information end
Note: Changing the severity level to 'information' will make the syslog more verbose. It is recommended to verify any storage space concerns if this setting needs to be retained. Otherwise, advanced free-style filters can be used to filter out specific log events, as described in Technical Tip: Configuring advanced syslog free-style filters.
Related articles: |
