Hostnames in FortiAnalyzer

5 replies
27825 views

Hi,

In log view or FortiView I'd like to see netbios / host names next to the IP address - or as a column - for each entry. This would save me from doing individual reverse lookups in our internal DNS.

I've looked at the settings and added columns for "host name" but they are not populated. Am I missing a setting somewhere to achieve this?

chall_FTNTAnswer

Staff

It is possible that your FortiGate is not configured to resolve the IPs to hostname when generating the logs. This is the most accurate approach.

To resolve Destination IP on the FortiGate

config log setting set resolve-ip enable end

But FortiAnalyzer can resolve the IPs for FortiView & Reports, just not Log View.

1) FortiView On FortiAnalyzer, for FortiView widgets, using DNS resolution to resolve IPs to hostname is configurable via the CLI: config system fortiview setting set resolve-ip {enable | disable} end 2) Reports "Resolve hostname" can be configured at both Report & Chart level

chall_FTNTAnswer

Staff

It is possible that your FortiGate is not configured to resolve the IPs to hostname when generating the logs. This is the most accurate approach.

To resolve Destination IP on the FortiGate

config log setting set resolve-ip enable end

But FortiAnalyzer can resolve the IPs for FortiView & Reports, just not Log View.

1) FortiView On FortiAnalyzer, for FortiView widgets, using DNS resolution to resolve IPs to hostname is configurable via the CLI: config system fortiview setting set resolve-ip {enable | disable} end 2) Reports "Resolve hostname" can be configured at both Report & Chart level

TomWhiAuthor

New Member

Thank you!

I'll look at implementing it on the FortiGates themselves eventually but I've enabled it in Analyzer as you described and that gives me enough information to get me started. It's a shame it's not available in Log View but I'll try to find another way to get that information.

Thanks again.