FortiPAM
FortiPAM allows you to protect, isolate and secure privileged account credentials, manage and control privileged user access, and monitor and record privileged account activity.
Jackie_T
Staff & Editor
Staff & Editor
Article Id 409385
Description

This article describes the steps to enable the PAM debug logs on FortiClient, which is disabled by default.

Scope FortiClient with FortiPAM enabled.
Solution

FortiPAM with FortiClient relies on FortiVRS for video recording. For more information about the FortClient Side process can refer to the below KB article:

Troubleshooting Tip: General Client-side Debugging Tips/Info

 

By default, FortiVRS logs are not enabled. To enable logging for the FortiVRS process, configure on FortiEMS if FortiEMS is in use or edit manually on the FortiClient config file.

 

Option 1: Configure on FortiEMS.

  • Go to Endpoint Profiles -> System Settings. Select the profile that the FortiClient applied with. Example here uses the 'Default' profile.

 

EMS system profile.png

 

  • Select the XML tab on the top right corner, and look for lines below:

 

<level>x<level>

<log_events>av,sslvpn…..<log_events>

 

  • Ensure the level is set to 7 and PAM is included in the events entry.

 

<level>7<level>

<<log_events>av,sslvpn…..,pam<log_events>

 

  • Save the setting.
  • Wait for the FortiClient to sync with EMS, and the configuration on FortiClient will be updated.

 

Option 2: Edit the FortiClient config file.

  • On FortiClient, go to settings and back up the config file.

 

FCT config.png

 

  • Open the config file with a text editor such as Notepad++. Look for the same line as in the first option. Ensure the level is set to 7 and PAM is included in the events entry.

 

<level>7<level>

<<log_events>av,sslvpn…..,pam<log_events>

 

  • Save the setting. After that, restore the saved configuration to FortiClient.
  • To verify that the logs are enabled, go to the path: FortiClient Installation Path\logs\trace. For example, the default installation path is C:\Program Files\Fortinet\fortiClient\logs\trace. Under the trace folder, FortiVRS files will show some logs if the debug is enabled successfully.