Skip to main content
JohnMeteo
New Member
Jun 12, 2015 10:56 AM UTC
Solved

Session logging

Good day.

 

Is there a way for logging to happen at session start? We notice that when we do an FTP, until we close the session, nothing appears in the log.

 

Thanks.

 

JM

Pradhumna_FTNT
Staff
Jun 12, 2015 11:07 AM UTC

Hi,

 

Yes,

 

This can be enabled on the specific firewall policy

 

config firewall policy

edit <id>

 set logtraffic-start enable

end

 

This will generate a log message , when the session is started and also a log message after the session is closed.

 

Regards,

Pradhumna chandra

 

4 replies

Pradhumna_FTNT
Staff
Staff
Jun 12, 2015 11:07 AM UTC

Hi,

 

Yes,

 

This can be enabled on the specific firewall policy

 

config firewall policy

edit <id>

 set logtraffic-start enable

end

 

This will generate a log message , when the session is started and also a log message after the session is closed.

 

Regards,

Pradhumna chandra

 

JohnMeteo
JohnMeteoAuthor
New Member
Jun 12, 2015 9:16 PM UTC

Many thanks. It does work and I did some tests like establish a FTP session and download some files but nothing is log during the session. When I close the ftp session, I get a log but the bytes send/receive does not match the transfer I did.

 

How do I get the session log properly?

 

Thanks,

 

JM

Pradhumna_FTNT
Staff
Staff
Jun 15, 2015 7:33 AM UTC

Hi,

 

Thanks for your update.

 

If your device has NP (Network processor) after the connection is setup the traffic gets offloaded to Network processor, due to which we will not be able to see the complete traffic details in the log.

 

We can disable this option on the specific firewall policy

 

config firewall policy

edit <id>

set auto-asic-offload disable

end

 

You can also refer this KB for more information regarding the same

 

http://kb.fortinet.com/kb...c&externalId=13851

 

Regards,

Pradhumna chandra

emnoc
New Member
Jun 16, 2015 7:14 AM UTC

I would  suggest not doing that, you will not offload this to traffic and will drive the cpu higher . Is there any reason why you need ongoing active/realtime sessions information?

 

As explained earlier the traffic is offloaded, so you can't really gain ongoing session statistics until the session is closed.

 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT