| Description | This article describes how to disable logging for specific IPS signatures within an IPS profile. This can be useful if an administrator wants to reduce unnecessary logging of IPS events in-general (for example, reducing logging of monitored/allowed traffic). |
| Scope |
FortiGate. |
| Solution |
Important Note before starting:
IPS rules with the block action are always logged, regardless of what the log option is set to in the IPS rule configuration (i.e. it is expected behavior that traffic dropped by an IPS signature will always result in an IPS event log being generated).
With that in mind, the IPS rule must be configured with set action pass (i.e. explicitly allowing traffic matching a signature/filters) or set action default (as long as the IPS Signature itself has a default action of Pass). It is also important that traffic matching these signatures are confirmed to be not a threat (e.g. known false-positives that are safe to disable logging for).
Disabling logging for specific IPS Signatures To disable IPS signature logging, start by checking existing IPS log details and identifying the Attack ID of the IPS signature.
To do this, navigate to Log & Report -> Security Events -> Intrusion Prevention, select an appropriate log entry, then either double-click or select the Details button in the upper-right corner to view the log details. For example, in the following screenshot the IPS attack ID matching this traffic is '14757':
Next, open the CLI and modify the IPS sensor using the following commands:
config ips sensor edit <name> config entries edit <id> set rule <attack_id> next end next end
For example, the following example will modify the 'ips_test_14757' IPS sensor and add/modify rule #1 to pass matching traffic without generating a log entry:
config ips sensor edit ips_test_14757 <----- Example name of IPS sensor. config entries edit 1 <----- ID of IPS signature/filter rule. set rule 14757 <----- Attack ID of the IPS signature. next end next end
Note that logging can also be controlled from the GUI. The following shows GUI actions and their CLI equivalents:
After disabling logging, traffic matching Attack ID 14757 will no longer generate an IPS Event Log.
Side Note regarding Automation Stitches: The 'IPS Event' Automation-Trigger will trigger whenever an IPS signature event is logged (blocked or monitored). Keep this in mind if there is false-positive traffic hitting a block rule, as it could result in a significant number of logs/alerts being generated. |
