Technical Tip: How to verify configuration changes in FortiGate and download logs

[mpeddalla]

Description	This article describes how to track/verify changes in the FortiGate.
Scope	FortiGate v7.2.x above.
Solution	When there is a requirement to audit the changes to the firewall configuration. Use the steps below to filter and download logs: Navigate to 'Log & Report' -> 'System Events' and ensure 'General System Events' is selected near the top right of the pane.  Example 1:  From the screenshot, Administrator user: admin created the firewall local user name: sslvpn. Another log shows the earlier user:sslvpn being added to the group name: sslvpn. Example 2:  From the above log, Admin User: admin created a new Firewall policy with the name: Policytointernet. Example 3:  Similar to earlier logs, the above screenshot shows Admin user: admin changed the DNS from 96.45.45.45 to 8.8.8.8. With the filter feature, using article below could adjust additional settings to verify more precise logs by adjusting time/date. Technical Tip: How to apply filters in forward traffic logs Technical Tip: Filtering for security event logs on FortiOS version 7.2 To download the retrieved logs, use the steps in the article below. Technical Tip: How to download Logs from FortiGate GUI