No FortiGate log for admin user creation events

Hi there,

Is it normal that FortiOS doesn't log admin user creation events? I figured it was standard practice. I can't find anything regarding admin user events in the log reference. Thank you.

While I'm here, I actually have a few more questions about different logged events. For example, is there any reference to explain the difference between Log ID 00003 (Traffic violation - deny) and Log ID 00011 (Failed connection attempts)? To my understanding, these are quite similar. Does log ID 00011 only get logged for TCP syn packets and 00003 for any packet/port/protocol? Thank you!