Event log when modify, crete, add or delete administration user

[luca1994]

Hello team,

On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?

Thanks in advance

BR

[abarushka]

Hello,

System event log is generated. You can find it by navigating GUI: Log & Report - Events - System events and search for string in the message "system."

[ebilcari · Accepted solution]

It is log ID 0100044547 for both adding and deleting in General System Events and enabled by default:

- Add system.admin

- Delete system.admin

Log ID	0100044547
Type	event
Sub Type	system