Skip to main content
luca1994
Explorer III
December 1, 2023
Solved

Event log when modify, crete, add or delete administration user

  • December 1, 2023
  • 5 replies
  • 4059 views

Hello team,

 

On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?

 

Thanks in advance

BR

Best answer by ebilcari

It is log ID 0100044547 for both adding and deleting in General System Events and enabled by default:

Add system.admin

Delete system.admin

Log ID 0100044547
Type event
Sub Type system

 

logid.PNG

5 replies

abarushka
Staff
Staff
December 1, 2023

Hello,

 

System event log is generated. You can find it by navigating GUI: Log & Report - Events - System events and search for string in the message "system."

ebilcari
Staff
ebilcariAnswer
Staff
December 1, 2023

It is log ID 0100044547 for both adding and deleting in General System Events and enabled by default:

Add system.admin

Delete system.admin

Log ID 0100044547
Type event
Sub Type system

 

logid.PNG

Emirjon
Bloa
New Member
August 22, 2024

Is this log ID still accurate as of 08/2024?

ebilcari
Staff
Staff
August 22, 2024

Those usually don't change, have you tested it and not getting the same log ID?

From a quick search it appears also in FortiOS 7.6.

Emirjon
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.