Skip to main content
mhdganji
mhdganji
Explorer III
April 27, 2022
Solved

Detailed log of configuration changes

  • April 27, 2022
  • 2 replies
  • 72531 views

Hi,

 

I need a simple way or at least the easiest way :) to find the details of configuration changes. Just knowing John changed this rule is not enough. I need details: John added this object to source, removed that destination, changed the protocol and so on. Any help would be appreciated. BTW, desired is to see this on memory and system events log not on syslog messages forwarded to a log server.

 

Regards,

    Best answer by jintrah_FTNT

    Hi,

     

    On GUI also, it should be seen. 

    Please check once you hover the mouse over cfgattr fields.

     

    Best regards, 

    Jin

    2 replies

    jintrah_FTNT
    Staff
    jintrah_FTNT
    Staff
    April 28, 2022

    Hello,

     

    This info is already available from the system event logs,

     

    date=2022-04-28 time=07:57:33 eventtime=1651125453584236132 tz="+0200" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="john" ui="GUI(10.5.63.254)" action="Edit" cfgtid=12714067 cfgpath="firewall.policy" cfgobj="7" cfgattr="uuid[c2b1795e-c488-51ec-ee70-f00a4eaee6a9]srcaddr[all->IPSec_RICH_172.24.216.50]" msg="Edit firewall.policy 7"

     

    Here you can see john edited firewall rule 7 and changed the source address from 'all' to an address object "IPSec_RICH_172.24.216.50".

     

    Best regards,

    Jin

      mhdganji
      mhdganjiAuthor
      Explorer III
      April 28, 2022

      In the system events in GUI, I cannot find these details. Should I enable verbose or detailed logging somewhere or in any way these logs are only available in CLI or syslog messages?

      jintrah_FTNT
      Staff
      jintrah_FTNTAnswer
      Staff
      April 28, 2022

      Hi,

       

      On GUI also, it should be seen. 

      Please check once you hover the mouse over cfgattr fields.

       

      Best regards, 

      Jin

        Yurisk
        SuperUser
        Yurisk
        SuperUser
        April 28, 2022

        As the post above mentioned, it is already in the logs, provided you have Log & Report -> Log Settings -> either "All" or "Custom: System activity events" enabled. 

        Below is screen shot of such log I didn't change any settings on the FOrtigate - all logs are on default:

         

        ftnt-forums-log.png 

         

        N.B. I know, not helping immediately - but new FortiOS 7.2 has this awesome feature "Audit Trails" , which will eventually fulfill this need :) https://www.linkedin.com/posts/yurislobodyanyuk_fortigate-activity-6924289976046088192-4N9z?utm_source=linkedin_share&utm_medium=member_desktop_web

         

         

          Terms & ConditionsAccessibility statement