Skip to main content
jmillward
jmillward
New Member
March 28, 2018
Question

Fortigate displays config changes but Fortianalyzer can't pull report

  • March 28, 2018
  • 1 reply
  • 7411 views

Hi Guys,

 

I am using a Fortigate 900D on which I can see the logs of config changes by administrators by filtering on the log ID's 44544, 44545, 44546 and 44547.

 

 

We are also using a Fortianalyzer 400E on which I am trying to run a report to match on system events to match on cfgattr; cfgobj; and cfgpath but nothing is shown after running the report. All event logs are being sent to the FAZ. I have attached a screenshot of the Forti and the FAZ.

 

Any help would be most welcome!

 

Thanks,

 

Jonathan

1 reply

dmcquade
dmcquade
New Member
April 11, 2018

I don't see any values set in your 3 filters. Could that be the problem? From the log view, once you have the data filtered to your liking, save the query which you can then use in a report.

 

HTH

d

jmillward
jmillwardAuthor
New Member
April 11, 2018

Thanks,

 

I solved it by creating a dataset which pulls from the log and then created a chart that uses that dataset.

 

I found the following post very helpful https://forum.fortinet.com/tm.aspx?m=144882 

 

:)

Terms & ConditionsAccessibility statement