Skip to main content
soheil_amiri
soheil_amiri
New Member
December 24, 2020
Question

SYSlog message description

  • December 24, 2020
  • 1 reply
  • 8509 views

hello guys

we configure fortigate device to send logs to Splunk Server via syslog, for future log analyzing.

what are this message meaning and when they happen:

Action

Ftnt_action

Vendor_action

thanks

1 reply

emnoc
emnoc
New Member
December 24, 2020

We would need to see the context of the logtype to give you and exact answer but have you studied the log references for your version of fortios?

 

e.g

 

FortiOS Log Message Reference | FortiGate / FortiOS 6.4.4 | Fortinet Documentation Library

 

Ken Felix

soheil_amiri
soheil_amiriAuthor
New Member
December 24, 2020

Hello emnoc

i need to understand these log to create good report.

 i read FortiOS log message as i understand ( fortios 6.2.4):

Action filed is for traffic log type include : allow, block, teardown ftnt_actoin filed is for UTM log type :pass, dropped, clear_session,Close, Accept, Client-rst, server-rst, deny, time out, ip-conn, dns, allow, block vendor_action filed did not fing any answer : pass, dropped, clear_session, Close, Accept, Client-rst, server-rst, deny ,time out, ip-conn, dns, allow, block

Terms & ConditionsAccessibility statement