Skip to main content
jefazo92
Explorer II
July 18, 2024
Question

How may I select which specific events I want to log in a Fortigate?

  • July 18, 2024
  • 1 reply
  • 574 views

Hi everyone,

 

I want to be able to choose specific system events (e. g. failed login attempts, policy changes, etc.) to be logged. I have been reading the admin manual but have not found how I may achieve this. Within Log & Report - > Log Settings - > Global settings, there are only log categories (e.g. System activity events) but no explanation as to what specific events they refer to. Would you mind telling me how I may choose the events I want to log?

1 reply

ozkanaltas
Valued Contributor III
July 18, 2024

Hi @jefazo92 ,

 

If you want to filter the log before sending the syslog you can review this document. If you want to filter the logs directly on FortiGate, I know there is no such feature.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-syslog-filters-on-to-send-only-specific-logs/ta-p/194032

 

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-syslog-free-style-filters/ta-p/204606