Technical Tip: How to configure logging in memory in later FortiOS

[ighita]

Description

This article describes how to configure logging in memory in later FortiOS. Logging can be enabled by using either the GUI or the CLI. Both of them have been changed from previous releases. The configuration of logging in earlier releases is described in the related KB article below.

Scope

FortiGate.

Solution

From WebGUI:

1. Log into FortiGate.
2. Go to Log & Report -> Log Settings menu (if Virtual Domain is Enabled, set it under each VDOM). 
3.  Refer to Local Log -> enable Memory.
4.  Select Apply.

Note:

If FortiGate supports Disk logging, only the 'Disk logging' option is available under Local Logs settings and Memory logs can only enabled through the CLI. 

 

Enable log memory via CLI:

config log memory setting

set status enable

end

Set the Log level via CLI:

config log memory filter

set severity information

set forward-traffic [enable/disable]

set local-traffic [enable/disable]

set multicast-traffic [enable/disable]

set sniffer-traffic [enable/disable]

set ztna-traffic [enable/disable]

set anomaly [enable/disable]

set voip [enable/disable]

end

Related articles: 
Technical Note: How to configure logging to memory in FortiOS v5.0
Technical Tip: How to check/filter configuration changes logs
Technical Tip: How to perform a syslog and log test on a FortiGate with the 'diagnose log test' comm...
Technical Tip: How to configure syslog on FortiGate