Skip to main content
pkgh
pkgh
New Member
August 30, 2018
Question

Track which Administrator made changes to Policy

  • August 30, 2018
  • 1 reply
  • 18622 views

Hi All, going thru all the event logs and posts I am still unsure, how do I track which of our admin made changes

to the policy.

 

This is one basic requirement to track changes and find a culprit, as once the changes are caught, no one will accept without proof.

We have multiple administrators with their own user ID's

Fortigate 1000D in HA running OS 6.0

Fortianalyzer running 5.6

 

Any help ?

1 reply

ede_pfau
SuperUser
ede_pfau
SuperUser
August 30, 2018

config system global

...

    set revision-backup-on-logout enable
    set revision-image-auto-backup enable
end

This will save the config (and the firmware) after changes to the internal flash disk. Revisions are stored along with the username, and you can use the built-in 'diff' tool to see which changes were made.

live89
live89
Explorer III
August 30, 2018

Hi

 

You can do it by this way:

 

FGT notification (Log&Report > Alert E-mail > enable Configuration changes)

* you need to enable mail server on you FGT first at : config system email-server

 

Then you'll get this kind of message:

Message meets Alert condition

date=2018-08-29 time=13:43:18 devname=FGT1 devid=FG800D1234567890 logid="0100044545" type="event" subtype="system" level="information" vd="root" eventtime=1535539398 logdesc="Object configured" user="blablauser" ui="GUI(1.2.3.4)" action="Delete" cfgtid=10552034 cfgpath="firewall.policy" cfgobj="696" msg="Delete firewall.policy 696" 

 

and of course you can always see at Log&Report > System Events what has been changed in the fw settings

emnoc
emnoc
New Member
August 30, 2018

You can do this easy from the cli and use the  log and firewall.policy.xxx  for  the message  value.

 

Ken

 

Terms & ConditionsAccessibility statement