Skip to main content
jefazo92
Explorer II
July 19, 2024
Question

Why aren't the full log messages described in the FortiOS Log Reference manual?

  • July 19, 2024
  • 1 reply
  • 1300 views

Hi everyone, 

 

The full message descriptions present in the Fortigate events (e.g. Administrator X accpeted login disclaimer and logged in successfully from https(Y)) are not shown in the Log Message Reference Manual. If I go for the the log entry with the same Log ID (i.e. 32001), it only refers to successful login entry (LOG_ID_ADMIN_LOGIN_SUCC) but does not mention anything about the banner. This is really frustrating for me as I need to monitor certain events and I must how they will show in the Fortinet logs or if they will appear at all. In this case, where does acceptance of login banner appear in the log reference manual? It shows up in the GUI's Systen Events and in the log text file if I download the logs but not in the manual. 

 

1 reply

AEK
SuperUser
SuperUser
July 19, 2024

Hello Jefazo

I don't know if I understand well your issue, but I could find the related log in the FortiSwitch reference manual.

Administrator logged in successfully

ID

32001

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"Administrator <user_name> logged in successfully from <IP_address>\"

  • msg=\"Administrator <user_name> accepted login disclaimer and logged in successfully from <IP_address>\"

Meaning

An administrator logged in successfully.

 

Ref:  https://docs.fortinet.com/document/fortiswitch/7.4.0/fortiswitchos-log-reference/265060/system-log-messages

 

 
AEK
jefazo92
jefazo92Author
Explorer II
July 19, 2024

Thank you very much @AEK, I want to find out which logs do the messages for the events I want to log correspond to. I want to find a manual that shows me exactly the same that you have above for the FortiSwitch but for the Fortigate 100F. However, I have not found such document.

jefazo92
jefazo92Author
Explorer II
July 19, 2024

Also @AEK since the document you refer to is the FortiSwitch, I am not sure to what extent it is applicable to the Fortigate 100F :(