Technical Tip: How to include HTTP data in traffic log sent to FortiAnalyzer

[shafiq23]

Description	This article describes how to enable traffic packet(HTTP headers  & body) sent to FortiAnalyzer logging.
Scope	FortiWeb and FortiWeb-VM.
Solution	By default, FortiWeb only sends the traffic raw log to FortiAnalyzer for analytical log view. This would limit administrator visibility on traffic details such as HTTP headers and body. From CLI: FWB-02 # config log forti-analyzer FWB-02 (forti-analyzer) # show full-configuration config log forti-analyzer     set status enable     set severity information     set traffic_packet disable <----- Disabled by default.     set fortianalyzer-policy FAZ end FWB-02 (forti-analyzer) # set traffic_packet enable <----- Enable traffic packet forwarding FWB-02 (forti-analyzer) # show full-configuration config log forti-analyzer     set status enable     set severity information     set traffic_packet enable     set fortianalyzer-policy FAZ end From FortiAnalyzer GUI: Navigate to Log View > FortiWeb > Traffic. Select and double-click the log entry.  Find the Data field. Select Data icon to view packet details. Refer to below documentation for more information on FortiWeb-FortiAnalyzer logging integration: Logging