| Extended HTTP logging must now be enabled per policy or globally for implicit policy. config firewall policy edit <policy_id> set log-http-transaction enable set extended-log enable next end
config webproxy global set extended-log enable end
When extended-log is enabled, the following fields are included in http-transaction logs: -
useragent -
referralurl -
httpmethod -
statuscode -
rawdata Example 1: Policy without extended-log: config firewall policy edit 1 set type explicit-web set name "test" set uuid 93a19b94-fdc3-51f0-34e0-74a93104af20 set dstintf "port1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "webproxy" set explicit-web-proxy "web-proxy" set utm-status enable set logtraffic all set ssl-ssh-profile "custom-deep-inspection" set av-profile "g-default" set webfilter-profile "monitor-all" set application-list "g-default" next end
Result:
Only basic traffic logs are generated. Extended HTTP fields are not present. 2: date=2026-01-30 time=02:29:09 eventtime=1769768949137934200 tz="-0800" logid="0000000015" type="traffic" subtype="forward" level="notice" vd="root" srcip=172.25.45.167 srcport=63844 srcintf="port2" srcintfrole="undefined" dstip=104.18.26.120 clientip=172.25.45.167 dstport=443 dstintf="port1" dstintfrole="undefined" srccountry="Reserved" dstcountry="United States" sessionid=16777572 proto=6 action="start" policyid=1 policytype="policy" poluuid="93a19b94-fdc3-51f0-34e0-74a93104af20" policyname="test" service="HTTPS" trandisp="noop" url="https://example.com/" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" appid=34039 app="HTTP.BROWSER_Chrome" appcat="Web.Client" apprisk="elevated" duration=41 sentbyte=0 rcvdbyte=0 sentpkt=0 rcvdpkt=0
Example 2: Policy with extended-log enabled: config firewall policy edit 1 set type explicit-web set name "test" set uuid 93a19b94-fdc3-51f0-34e0-74a93104af20 set dstintf "port1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "webproxy" set explicit-web-proxy "web-proxy" set utm-status enable set logtraffic all set log-http-transaction enable set extended-log enable set ssl-ssh-profile "custom-deep-inspection" set av-profile "g-default" set webfilter-profile "monitor-all" set application-list "g-default" next end
Result:
Detailed http-transaction logs are generated, including method, status code, referral URL, and raw HTTP data. 23: date=2026-01-30 time=02:30:24 eventtime=1769769024018430505 tz="-0800" logid="0010000099" type="traffic" subtype="http-transaction" level="notice" vd="root" srcip=172.25.45.167 dstip=104.18.26.120 clientip=172.25.45.167 scheme="https" srcport=63890 dstport=443 hostname="example.com" url="https://example.com/favicon.ico" prefetch=0 policyid=1 sessionid=16777583 transid=16778061 reqlength=136 resplength=458 rcvdbyte=5500 sentbyte=2883 resptype="normal" referralurl="https://example.com/" httpmethod="GET" cat=52 catdesc="Information Technology" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/143.0.0.0 Safari/537.36" statuscode="404" rawdata="Time=-1769751ms|[REQ] Host=example.com|[RESP] content-type=text/html" reqtime=1769769024 resptime=1769769024 respfinishtime=0 duration=0 appcat="unscanned" utmaction="allow" countweb=1 utmref=65529-1220 24: date=2026-01-30 time=02:30:24 eventtime=1769769023925667218 tz="-0800" logid="0010000099" type="traffic" subtype="http-transaction" level="notice" vd="root" srcip=172.25.45.167 dstip=104.18.26.120 clientip=172.25.45.167 scheme="https" srcport=63890 dstport=443 hostname="example.com" url="https://example.com/" prefetch=0 policyid=1 sessionid=16777583 transid=16778059 reqlength=485 resplength=150 rcvdbyte=4976 sentbyte=2725 resptype="normal" httpmethod="GET" cat=52 catdesc="Information Technology" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" statuscode="304" rawdata="Time=-1768843ms|[REQ] Host=example.com" reqtime=1769769023 resptime=1769769023 respfinishtime=0 duration=0 appid=34039 app="HTTP.BROWSER_Chrome" appcat="Web.Client" apprisk="elevated" applist="g-default" utmaction="allow" countweb=1 countapp=1 utmref=65529-1194
Note 1: As of FortiProxy v7.4.5GA, log-http-transaction option has changed from '[all | utm | disable]' to '[enable | disable]'. Note 2: For IPS and WAF, the extended-log can still be configured in IPS and WAF profiles. Related documents: Explicit proxy logging | 
