Policy UUID - Logs & Reports

Forum|Forum|9 years ago
October 27, 2016
8 replies
14509 views

Friends,

Why is it that I see policy UUID in some of the logs while it is absent in others?

5.2

emnoc

New Member

You can enable UUID logging or lack of. It's very help if you are tacking items by UUID. I use it a lot btw.

global options

set log-uuid policy-only

Ken

faizanshaikh_netAuthor

New Member

Hi Ken,

Actually, I could see some unusual logs in my Logs & Reports section. There is a policy which is disabled for logging completely, yet I see that there are huge logs generated through it. I am assuming that these logs are junk. When I right click the policy after enabling it, and select "matching logs" I can only see the logs with UUID associated to them.

I am pretty new to Fortigates :)

emnoc

New Member

There is a policy which is disabled for logging completely, yet I see that there are huge logs generated through it.

Explain? How could that be?

If you have logging enable for category traffic, & traffic that matches that fwpolicy , you will send a log message. If you have UUID enable for policy, the log message is tagged with the UUID. There's no way you can have it disable and still see logging imho & I don't know what you mean by "junk logs".

Login thru ssh or jsconsole and find the firrewallpolicy and look for the log traffic set command? What is it set for?

example

show full firewall policy 7 | grep log

set logtraffic all

set logtraffic-start disable

Ken

Sign up

Login with SSO

Login to the community

Login with SSO