Technical Tip: How to review user creation logs to determine who created it

[jbindra]

Description	This article describes where to find logs for the creation of a local user and determine who created the user.
Scope	FortiGate.
Solution	Information and details can be collected for User creation by reviewing the log located under System events. This will allow an administrator to know who created the user including the time and date. In the given example, a local test user is created by navigating to: User & Authentication -> User definition -> Create new -> Local user -> provide username and password -> Next -> Submit. To check the logs related to that, navigate to Logs & Report -> System Events. This log can be further expanded to see more details: If there are multiple logs, an appropriate log filter can be applied to see the user creation logs: Under the Log Description column, filter for 'Local user added'.