Extract UTM event logs

[yamamoto]

Dear Experts,

I am trying to download law log data from traffic log and create some customized report

of UTM events like "IPS detected" "IPS blocked"  with my own reporting tools.

As I need Weekly and Monthly statical data, Fortigate's daily report function is not enough.

Is there any way to extract only UTM event logs within a specific time period?

- Fortigate-240D / v5.6.3

Any Suggestions?

[emnoc]

You  might want to look at  diag log show cmds from the cli.

FWIW: Messages written to disk can be queried by filters  but in your case, I would look at   remote-syslogd and  something like sawmill/splunk/logentries/etc.... and export the logs in some  readable format { CEF SYSLOG CSV } and get it off the platform into the collector.

Here you only need to export the logs and start using the services. Once you get the log data  into your collection, your tools and platform is all on you ;)

[yamamoto]

Dear emnoc

Thank you for your quick and kind response.

Seems like I need much more skills and training with Logging Master.

Anyway, I could find the way what I should do first. 

Thank you.