Skip to main content
fuks87i
fuks87i
New Member
August 18, 2014
Question

FortiAnalyzer- the problem with logs.

  • August 18, 2014
  • 7 replies
  • 7949 views
Hi, Our FA1000C has been upgraded to 5.06 version. Device is collecting logs file from FortiGates. When I go to the Log View, Traffic Log I see columns: Date/Time, Source/View, Destination IP, Service, Sent/Received, User and VPN for VPN ipsec Traffic. There is a problem with column " User" , because is empty, does not display any information, in contrast to other( full information). How do I know which user (AD login) was logged in the past, since I can only see the IP address( Column Source/Device) ? The Event Log-> VPN contains information about the AD user(xauthUser) but does not display other information(source, destination IP, service). These are empty records. I tried to create new dataset which contains logs from Traffic and Event but it does not give the expected result. Situation like the one described above.Should Should I focus on creating an appropriate DATASET joined by two LOG files (Traffic and Event VPN)? Is that possible to create a new query with two diffrent log files? Regards, Fuks

    7 replies

    L_FTNT
    Staff
    L_FTNT
    Staff
    August 19, 2014
    Have you tried the factory default VPN usage report? This report supports FGT 5.0 or later and it has a number of improvements in FAZ 5.0.7.
    fuks87i
    fuks87iAuthor
    New Member
    August 20, 2014
    hi, i have tried to use The default VPN usage raport but dataset " Top Dial-up VPN Users By Duration" but it does not give Information about DestinationIP, Service and Source IP. For now I created two new querries, one from Traffic log and one from Event Log. It' s hard to find a common element which it will be use to locate user from Event Log and localize him in Traffic Log. Even Data/Time is diffrent between two logs for logged user (many services used when user was logged). I Can' t find 100% match for single user. 5.07? Can anyone confirm that reports in 5.07 are much better and give more information than firmware 5.06?
    fuks87i
    fuks87iAuthor
    New Member
    August 21, 2014
    Additional question: Can I generate report in CSV format?
    L_FTNT
    Staff
    L_FTNT
    Staff
    August 21, 2014
    Hi there,
    For now I created two new querries, one from Traffic log and one from Event Log. It' s hard to find a common element which it will be use to locate user from Event Log and localize him in Traffic Log. Even Data/Time is diffrent between two logs for logged user (many services used when user was logged). I Can' t find 100% match for single user.
    This is a known limitation with FGT 5.0 (or earlier) IPsec VPN. With 5.2 FOS, if you follow the new way to configure IPsec VPN (not configure user group in the IPsec Phase 1 but config the authentication in the policy), you will get the correct IPsec VPN user info in the traffic log.
    Additional question: Can I generate report in CSV format?
    For 5.0.7, it supports PDF and HTML formats - CSV is not supported.
    fuks87i
    fuks87iAuthor
    New Member
    August 22, 2014
    L.Clarke thanks a lot! Now i have clear vision about FG reports. Can I use an external tool, like a SQLite Database Browser or use other postgres tool, to connect into internal FA log database (need to know login and password)?
    Istvan_Takacs_FTNT
    Staff
    Istvan_Takacs_FTNT
    Staff
    August 22, 2014
    You can' t login to the FAZ DB, but you can configure it to use an external DB server. That way you could do whatever you want with the data in that MySQL DB. You can also create your custom reports by using SQL queries on FAZ, but for that you need to use the built-in CLI instead of a 3rd party tool. Eg. config report dataset edit <dataset_name> set query <sql_statement> next end
    Warren_Olson_FTNT
    Staff
    Warren_Olson_FTNT
    Staff
    August 22, 2014
    If CLI isn' t your preference you can go to datasets within the report options and create a custom one, then put in postgres to query the db directly and click ' test' to see the output.
    fuks87i
    fuks87iAuthor
    New Member
    August 26, 2014
    in near future I' ll decide which solution will be used. Warren Olson, I tried this all the time but did not get the correct result.
    Terms & ConditionsAccessibility statement