Skip to main content
lostboy10
lostboy10
Explorer II
February 27, 2024
Question

Audit logs in Fortimanager

  • February 27, 2024
  • 3 replies
  • 4651 views

I am trying to view Audit logs for users in FortiManager 7.4.2 like which user installed a policy or changed an object.

where can i find these ? Do i need to enable any setting for this ? 

i tried to check in system settings-> events logs but that section is empty ..only when i select real time in top right i can see any logs there.. is this expected ? or is it a bug in 7.4.2

 

Thanks

3 replies

AEK
SuperUser
AEK
SuperUser
February 27, 2024

I have 7.2.2 and I can see the logs (System Settings-> Events Log), e.g.: when I select "Last 1 Hour" the logs are displayed correctly.

This was the default setting and nothing has been changed for that.

AEK
    lostboy10
    lostboy10Author
    Explorer II
    February 29, 2024

    i m not sure if its a problem with the version ..i m on 7.4.2 and i think it worked fine when i was on 7.4.1

    vraev
    Staff
    vraev
    Staff
    February 28, 2024

    Hi @lostboy10 

    I would suggest to review the following article:
    https://community.fortinet.com/t5/FortiManager/Technical-Tip-FortiManager-FortiAnalyzer-local-event-logs-setup/ta-p/262873

    Also, for the local log :

    faz.example.com # config system locallog disk setting

    (setting)# get
    path=system.locallog.disk, objname=setting, tablename=(null), size=336
    status : enable
    severity : debug <--- All possible events to be saved
    upload : disable
    server-type : FTP
    max-log-file-size : 100
    max-log-file-num : 10000
    roll-schedule : none
    diskfull : overwrite
    log-disk-full-percentage: 80
    log-disk-quota : 1

    Please review that you had enough disk space.
    Best,

      lostboy10
      lostboy10Author
      Explorer II
      February 29, 2024

      Thanks..i verifed this and disk space looks fine

      ScottGunnar
      ScottGunnar
      New Member
      February 28, 2024

      Check if logging is properly configured on your FortiManager device. Ensure that the appropriate log settings are enabled to capture user activities in gb insta.

      lostboy10
      lostboy10Author
      Explorer II
      February 29, 2024

      Where do i see that ? i am not sure but is it a kknown problem with forti OS 7.4.2 ?

      smkml
      Staff
      smkml
      Staff
      February 29, 2024

      Hi @lostboy10 ,

       

      Do FortiAnalyzer features enabled? You may proceed to perform database rebuild by below command to see it able to rectify the issue.

       

      # execute sql-local rebuild-db

      Terms & ConditionsAccessibility statement