Technical Tip: FortiManager event logs for long address Group (device mapping modification)

In this article, 160 hosts (host-001 to host-160) were created to simulate a very long list of objects added to a group named My_group. The logs will be shortened to help with readability when possible. 

Explanation:

1. When the logs are too long and need to be split into multiple records:

1. The format when the CDB logs needs to be split into 2 records:

<log header>changes="[ 1] ..."

<log header>changes="... [ 1]"

2. The format when the CDB logs needs to be split into 3 records:

    

<log header>changes="[ 2] ........"

<log header>changes="[ 1]....[ 2]"

<log header>changes=".........[ 1]"

2. When changes are made to the group, the new list of members is listed, followed by the original list of members in parentheses.

<log header>changes="type= fw_addrgrp, key= My_group,...,member=<new list of members>(<original list of members>)"

3. When changes are made to [Per-Device-Mapping], the type becomes fw_addrgrp_dynamic_mapping and the word dynamic will be added to the key in parentheses.

changes="type=fw_addrgrp_dynamic_mapping,key= My_group(dynamic)

4. Sample Logs:

1. When Host_001 to Host_005 were deleted.  In the first record (at the bottom), members start from Host_006 and end at Host_160. After that, the original list of members is added in parentheses. The [  1] marker denotes the end of the first record and is carried on in the second record. Host_030 was truncated into 'H' in the first record and 'ost_030' in the second record. The key is part of the changes and will only be listed in the first record.

2025-12-21 13:32:05 tz="+0800" log_id=0021030002 type=event subtype=objcfg pri=notice desc="cdb event log for object changed" user="admin" userfrom="GUI(192.168.212.2)" msg="" adom="MyFGT" session_id=32884 operation="edit" performed_on="dev=global,adom=MyFGT" changes="[  1]: ost_030 Host_031 <Host_032 to Host_158 truncated> Host_159 Host_160)"

2025-12-21 13:32:05 tz="+0800" log_id=0021030002 type=event subtype=objcfg pri=notice desc="cdb event log for object changed" user="admin" userfrom="GUI(192.168.212.2)" msg="" adom="MyFGT" session_id=32884 operation="edit" performed_on="dev=global,adom=MyFGT" changes="type=fw_addrgrp,key= My_group,uuid=0c6b9c14-dcc2-51f0-5efd-6f4eadfac9cb,member=Host_006 Host_007 Host_008 Host_009 Host_010 <Host_011 to Host_158 truncated> Host_159 Host_160 (Host_001 Host_002 <Host_003 to Host_027 truncated> Host_028 Host_029 H [  1]" 

2. When objects Host_001 to Host_003 are deleted from My_group, which has only 20 hosts, 'dynamic' is added to the key.

2025-12-21 13:56:47 tz="+0800" log_id=0021030002 type=event subtype=objcfg pri=notice desc="cdb event log for object changed" user="admin" userfrom="GUI(192.168.212.2)" msg="" adom="MyFGT" session_id=32884 operation="edit" performed_on="dev=FG-301E-02,vdom=root" changes="type=fw_addrgrp_dynamic_mapping,key= My_group(dynamic),member=Host_004 Host_005 Host_006 Host_007 Host_008 Host_009 Host_010 Host_011 Host_012 Host_013 Host_014 Host_015 Host_016 Host_017 Host_018 Host_019 Host_020(Host_020 Host_019 Host_018 Host_017 Host_016 Host_015 Host_014 Host_013 Host_012 Host_011 Host_010 Host_009 Host_008 Host_007 Host_006 Host_005 Host_004 Host_003 Host_002 Host_001)"