Technical Tip: Difference between 'logid="0100044547"' and 'logid="0100044546"' which are generated when configuration is changed in the FortiGate

[nithincs]

Description	This article describes when logs with 'logid="0100044547"' and 'logid="0100044546"' are generated and how to verify the logs for configuration changes down in the FortiGate device.
Scope	FortiGate.
Solution	FortiGate will generate two kinds of LOGIDs when configuration changes are made. 44547 - LOGID_EVENT_CONFIG_OBJATTR. logid="0100044547" logdesc="Object attribute configured" FortiGate generates logs with 'logid="0100044547"' when there is an object created/modified/deleted in the FortiGate. For example: A new policy is created: date=2025-04-10 time=05:01:53 eventtime=1744286513150014241 tz="-0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(10.32.22.115)" action="Add" cfgtid=126746708 uuid="961e8b5a-1603-51f0-e0c5-204b0b600edc" cfgcomment="test" cfgpath="firewall.policy" cfgobj="8" cfgattr="name[testconfig]srcintf[port5]dstintf[port1]action[accept]srcaddr[all]dstaddr[all] schedule[always]service[ALL]nat[enable]" msg="Add firewall.policy 8" Existing policy is modified: date=2025-04-10 time=05:03:10 eventtime=1744286590387128198 tz="-0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(10.32.22.115)" action="Edit" cfgtid=126746709 uuid="961e8b5a-1603-51f0-e0c5-204b0b600edc" cfgcomment="c" cfgpath="firewall.policy" cfgobj="8" cfgattr="dstintf[port1->port2]" msg="Edit firewall.policy 8" Policy is deleted: date=2025-04-10 time=05:06:27 eventtime=1744286787571656776 tz="-0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(10.32.22.115)" action="Delete" cfgtid=126746710 uuid="eb78cb26-1601-51f0-9b28-c89c722306bf" cfgpath="firewall.policy" cfgobj="8" msg="Delete firewall.policy 8" In the examples mentioned above, configuration changes will result in logs with logID 0100044547 and logdesc 'Object attribute configured'. 44546 - LOGID_EVENT_CONFIG_ATTR. logid="0100044546" logdesc="Attribute configured" Similarly, FortiGate generates logs with 'logid="0100044546"' if there is a change to global and system attributes: For example: The DNS database is enabled in Feature Visibility, which changes the system settings: date=2025-04-10 time=05:05:48 eventtime=1744286748419148938 tz="-0700" logid="0100044546" type="event" subtype="system" level="information" vd="root" logdesc="Attribute configured" user="admin" ui="GUI(10.32.22.115)" action="Edit" cfgtid=126746712 cfgpath="system.settings" cfgattr="gui-dns-database[disable->enable]" msg="Edit system.settings " Admin timeout is changed from 5 to 120 minutes, which changes the global setting: date=2025-04-10 time=05:23:12 eventtime=1744287792378243085 tz="-0700" logid="0100044546" type="event" subtype="system" level="information" vd="root" logdesc="Attribute configured" user="admin" ui="jsconsole(10.32.22.115)" action="Edit" cfgtid=821297153 cfgpath="system.global" cfgattr="admintimeout[5->120]" msg="Edit system.global " In above mentioned examples, configuration changes will result in logs with 'logID 0100044546' and 'logdesc "Attribute configured"'. To verify the configuration changes done to objects such as policies, address objects, and admin accounts, use the filter with 'lologid="0100044547'. To verify the configuration changes done to the system and global settings, filter with 'logid="0100044546"'. For more information, check the FortiOS Log Message Reference Guide, for example: 44546 - LOGID_EVENT_CONFIG_ATTR  44547 - LOGID_EVENT_CONFIG_OBJATTR