Hi @shocko ,
FortiGate already writes a traffic-end log every time it ages-out a session. The record has logid 0000000013, type=traffic, subtype=forward, status/end, and the action=timeout (reason=agedout) field that indicates the session died because it hit the session-TTL timer. You can find more details about this event on the below link:
https://docs.fortinet.com/document/fortigate/6.4.9/fortios-log-message-reference/13/13-log-id-traffic-end-forward#aanchor139
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-ID-definitions/ta-p/191334
To log and monitor FortiGate session-TTL timeouts in FortiAnalyzer:
- Enable full session logging on the specific firewall policy that carries the application (logtraffic all in the CLI or Log allowed traffic → All Sessions in the GUI).
- Forward logs to FortiAnalyzer and ensure reliable delivery (set status enable and set reliable enable under FortiAnalyzer log settings).
- Create a custom Event Handler on FortiAnalyzer that filters traffic-end logs with action=timeout (or logid=13) and choose how you want to be notified (e-mail, SNMP, webhook, etc.).
After that, every time the FortiGate ages out a session because of the TTL, FortiAnalyzer records it and can alert you, giving clear visibility into applications that lack keep-alives.
BR.
If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.
CCIE #68781
