FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
kjiye
Staff & Editor
Staff & Editor
Article Id 405105
Description This article explains the phenomenon in which the 'Edit system.dhcp.server 1' log occurs even though there are no modifications to the DHCP server.
Scope FortiGate.
Solution

This occurs when the interface settings (allowaccess, etc.) are changed in the GUI.

The log remains as below:

 

edit_dhcp.jpg

 

date=2025-08-05 time=16:21:00 eventtime=1754385660358625200 tz="+0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(1.1.1.1)" action="Edit" cfgtid=11993151 cfgpath="system.dhcp.server" cfgobj="1" cfgattr="ip-range:1[<Delete>start-ip[2.2.2.1]end-ip[2.2.2.10]]" msg="Edit system.dhcp.server 1"
date=2025-08-05 time=16:20:39 eventtime=1754385638553779380 tz="+0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(1.1.1.1)" action="Edit" cfgtid=11993143 cfgpath="system.interface" cfgobj="Internal" 

 

The reason is that the GUI always reconfigures the DHCP server when interface settings are changed. If the interface has enabled the DHCP server and any attributes are changed in the interface, the message 'Edit system.dhcp.server 1' may appear. 

To find which object has been changed, the 'cfgattr' has to be checked from the log field. This will show the appropriate change made in that DHCP server enabled interface.