Technical Tip: Revision number of repeated auto update from FortiGate is not displayed in FortiManager configuration revision history

Sometimes, not all revision numbers in the Configuration Revision History of a device are displayed in FortiManager. It is because when there are repeated changes directly in the FortiGate, only the latest revision number of the auto updates will be displayed in the Configuration Revision History. This is the expected behavior.

For example, revision numbers 13 to 17 were missing.

These 'missing' auto updates from version 13 to 17 happened and can be verified by the system event log of FortiManager (In GUI, System Settings -> Event Log).

2025-04-17 12:12:10 tz="+0800" log_id=0012021008 type=event subtype=dm pri=information desc="Update config revision from device" user="AutoUpdate" userfrom="" msg="AutoUpdate from Ertiga-kvm34(FGVM010000101111): revision(17)" device="Ertiga-kvm34" serial="FGVM010000101111" dev_oid=0 session_id=0 operation="Update and save device" performed_on="Ertiga-kvm34" changes="AutoUpdate from Ertiga-kvm34(FGVM010000101111): revision(17)" revision=17

…

2025-04-17 12:10:18 tz="+0800" log_id=0012021008 type=event subtype=dm pri=information desc="Update config revision from device" user="AutoUpdate" userfrom="" msg="AutoUpdate from Ertiga-kvm34(FGVM010000101111): revision(13)" device="Ertiga-kvm34" serial="FGVM010000101111" dev_oid=0 session_id=0 operation="Update and save device" performed_on="Ertiga-kvm34" changes="AutoUpdate from Ertiga-kvm34(FGVM010000101111): revision(13)" revision=13

Note: When FortiManager is configured to send logs to FortiAnalyzer, the severity level has to be set to 'information' for the logs to be visible on the FortiAnalyzer:

config system locallog fortianalyzer setting
    set server "x.x.x.x"
    set severity information
end

Of course, it may also be possible that some configuration revisions were manually deleted by the user. Such manual deletion can be verified in the FortiManager event log. Sample event log for deletion of configuration revision is as follows for reference.

2025-03-31 16:15:06 tz="+0800" log_id=0012021016 type=event subtype=dm pri=notice desc="Delete revision" user="admin" device="Ertiga-kvm34" serial="FGVM010000101111" adom="" constmsg="Delete revision for the device" session_id=2580 operation="Device config delete revision" performed_on="Ertiga-kvm34" changes="Delete device revision 3" revision=3