Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
thegost4u
New Contributor

DLP log only mode is not working !!

Hello all !

IN DLP, i have a sensor which checks if files has the word "test", and the action is "log only", but it does not show anything in logs when i pass files.. why ??

i have enabled extended-utm-logs already.

my device is 100D and the software is v5.0,build0310 (GA Patch 11) [was on latest 5.3 and downgraded]

here is a screenshots of my current situation:

 

 

 

 

See it only logs when i set action to "block"

 

4 REPLIES 4
thegost4u
New Contributor

Ok, i made it work.. this is what i changed 

 

config dlp sensor edit "test" set comment "This is a test sensor" set replacemsg-group '' config filter edit 1 set type file set proto smtp pop3 imap http-post ftp nntp mapi set filter-by regexp set regexp "(T|t)(E|e)(S|s)(T|t)" set action log-only next end set extended-utm-log enable set dlp-log enable set nac-quar-log enable set flow-based disable unset options set full-archive-proto smtp pop3 imap http-get http-post ftp nntp aim icq msn yahoo mapi unset summary-proto next end

 

 

so others can make use of it in future ! 

thanks all for not helping :\ 

ede_pfau
SuperUser
SuperUser

hey,

 

no need to be rude, especially not here in a self-help forum. I get it that this upset you but you resolved the issue by yourself within 24 hours. I've been on a recent problem for more than 4 months until I found the solution, and didn't whince (much).

 

Back to your filter. If you are using an RE you can use the "i" switch to make the pattern case-insensitive, like in

"i/test/". FortiOS RE follow the perl syntax as far as I remember so switches should be included.

Maybe that'll help you in the future.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
thegost4u

ede_pfau wrote:

hey,

 

no need to be rude, especially not here in a self-help forum. I get it that this upset you but you resolved the issue by yourself within 24 hours. I've been on a recent problem for more than 4 months until I found the solution, and didn't whince (much).

 

Back to your filter. If you are using an RE you can use the "i" switch to make the pattern case-insensitive, like in

"i/test/". FortiOS RE follow the perl syntax as far as I remember so switches should be included.

Maybe that'll help you in the future.

 

Sorry for misunderstanding, i was implying that am sad not rude ^^

back to my filter, thanks for the case sensitive help ! i've been working so fast on it and i can't focus everywhere.

so if i want to apply a filter for "secret document" (in both capital and small letters) what do you advice to use as regex ?

ede_pfau
SuperUser
SuperUser

Alright.

I'd use "i/secret document/" but be aware that there is meant to be only 1 space between words.

"i/secret\s+document/" would match variable spaces or tabs between words.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors