FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Kraven2323
Staff
Staff
Article Id 209006
Description This article describes how to filter out the syslog message for the FortiGuard webfilter license expired alert.
Scope FortiGate.
Solution

Example of license expire alert:

 

Mar 20 17:40:50 10.98.98.194 date=2022-03-20 time=17:40:50 devname="FGT-Test-01" devid="FGT81ETK00000000"
eventtime=1647769250965713463 tz="+0800" logid="0100020109" type="event"
subtype="system" level="critical" vd="root" logdesc="FortiGuard web filter license expired" msg="FortiGuard Web Filter license is expired.

 

Set the following settings on Syslog filter to filter out the license expire message:

 

config log syslogd filter
    set severity critical
    set filter "logid(0100020109)"
    set filter-type exclude

  end

 

For multiple filters, use the following format:

set filter "logid(0100020109,0100020101)"

 

Important:

Starting v7.0 onwards, the syslog filtering syntax has changed.


Refer to 'free-style' syslog filters on those Firmware versions:

Technical Tip: Using syslog free-style filters

Technical Tip: Configuring advanced syslog free-style filters