Filtering on Rules does not work

FlashOver · ‎09-06-2012

HI. I have a FGT60C with the latest Release 4.3 Patch9. When I look to the traffic logging I se my traffic and in the collum Rule the number from the affectet rules. In the complete unfiltered overview I see that there are entries for rule 8. When I filter now to see only traffic which concerns rule 8 - the filter does not work fine and I see nothing anymore. it seems that when I filter to rule NUMBER it does not macht... Is that a bug?

cmberry · ‎09-07-2012

I can confirm logging filtering is busted on my 200B. I run 4.3.9, but I also had the problem on 4.3.8, and I think even prior recent firmwares. And it' s not only the " rule" column, I can' t get " Sent" or " Received" to filter and I am sure there are others that are bugged. Traffic Log columns like " Service" , " Dst" , " Src" , " Date" all work fine, so it' s not a complete bugging of the filtering. I hope they fix this soon, as it makes it very hard to track things down in the log!

Ken_M · ‎09-10-2012

I too have log problems. I' ve been working with support on this, but no resolution yet. Rule 2 is set not to log, yet it does. Other rules are showing " root" as dst interface, which is not selectable. I hope it gets fixed.

Ken_M · ‎09-11-2012

Logging is working for me after all. Even though I had rule 2 logging off, I had application rule turn on which caused the logging.

cmberry · ‎09-26-2012

I talked with support today, here' s the deal: Fortinet acknowledged the log filtering issue on 4.3.x It is widespread and affects most of the columns you can select on the Fortigate webconfig traffic log. Seems that it might also affect the FortiAnalyzer (but I dont have one, so I cant confirm). I did NOT get a bud ID, sorry. here' s the kicker, they do NOT seem to planning on fixing this issue in 4.0. They plan on fixing the issue in 5.0, which will be released soon. To me, this seems nuts. 4.3 is now on patch 10 and should be considered extremely stable and reliable and near perfect. And yet, there is a significant issue with log filtering to point where, filtering logs on a Fortigate running ~ 4.3.8-10 is BROKEN and useless. I wont be trying 5.0 until probably patch 3, so I guess it will be a long time until I get this fixed. I am posting this so people dont feel crazy or waste time contacting support about this issue.

FlashOver · ‎09-26-2012

It will be fixed in FOS5 - I have tried it already on Beta images. Exptect to get the final version in October or the beginning of November.