Skip to main content
noamsh88
noamsh88
Visitor III
October 2, 2023
Solved

How to config FortiGate to save 90 days logs history? (Forward Traffic and System Events)

  • October 2, 2023
  • 1 reply
  • 8509 views

Can someone advise how to config FortiGate to save 90 days logs history or to config limit for log size (up to 1GB log size)?

the FortiGate logs history we need are Forward Traffic and System Events

 

Best answer by hbac

Hi @noamsh88,

 

Those commands only work if your FortiGate supports disk logging. You can verify by running "get system status". Example below: 

 

Smough-kvm64 # get system status
Version: FortiGate-VM64-KVM v7.2.5,build1517,230606 (GA.F)
Security Level: 1
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
IoT-Detect: 0.00000(2022-08-17 17:31)
Serial-Number: 
License Status: Valid
VM Resources: 1 CPU/2 allowed, 1993 MB RAM
Log hard disk: Available     >>>    Disk logging is supported. 
Hostname: Smough-kvm64
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1517
Release Version Information: GA
FortiOS x86-64: Yes
System time: Mon Oct 2 09:12:11 2023
Last reboot reason: warm reboot

 

If disk logging is not supported. You can send logs to FortiGate Cloud which by default saves the logs for 7 days. You can purchase a license to be able to save logs up to 1 year. 

 

Regards,

1 reply

A
Anonymous_User
New Contributor III
October 2, 2023

Hi Team,

 

Please refer the below article
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-set-the-maximum-age-for-logs-on-disk/ta-p/193116
Let us know if you need any further assistance



noamsh88
noamsh88Author
Visitor III
October 2, 2023

Thanks, our "FortiGate 100F v6.4.6 build6131 (GA)" version seems not supporting this option
can you please advise if there is other CLI for this FortiGate version?

FG-101F-No # config log disk setting

command parse error before 'disk'
Command fail. Return code 1

FG-101F-No # config log setting

FG-101F-No (setting) # set maximum-log-age 90

command parse error before 'maximum-log-age'
Command fail. Return code -61

FG-101F-No (setting) # show full-configuration
config log setting
set resolve-ip disable
set resolve-port enable
set log-user-in-upper disable
set fwpolicy-implicit-log disable
set fwpolicy6-implicit-log disable
set log-invalid-packet disable
set local-in-allow enable
set local-in-deny-unicast enable
set local-in-deny-broadcast enable
set local-out enable
set daemon-log disable
set neighbor-event disable
set brief-traffic-format disable
set user-anonymize disable
set expolicy-implicit-log disable
set log-policy-comment disable
end

FG-101F-No (setting) #

hbac
Staff
hbacAnswer
Staff
October 2, 2023

Hi @noamsh88,

 

Those commands only work if your FortiGate supports disk logging. You can verify by running "get system status". Example below: 

 

Smough-kvm64 # get system status
Version: FortiGate-VM64-KVM v7.2.5,build1517,230606 (GA.F)
Security Level: 1
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
IoT-Detect: 0.00000(2022-08-17 17:31)
Serial-Number: 
License Status: Valid
VM Resources: 1 CPU/2 allowed, 1993 MB RAM
Log hard disk: Available     >>>    Disk logging is supported. 
Hostname: Smough-kvm64
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1517
Release Version Information: GA
FortiOS x86-64: Yes
System time: Mon Oct 2 09:12:11 2023
Last reboot reason: warm reboot

 

If disk logging is not supported. You can send logs to FortiGate Cloud which by default saves the logs for 7 days. You can purchase a license to be able to save logs up to 1 year. 

 

Regards,

Terms & ConditionsAccessibility statement