Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sioannou
Contributor

FortiGate diag log test question

Hi, 

 

Recently we received multiple logs from a FortiGate appliance that are related to the "diag log test" command like the one below 

 

date=2024-05-10 time=17:33:16 devname="firewall" devid="ID" eventtime= tz="" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="high" srcip=168.10.199.186 srccountry="United States" dstip=224.141.85.77 dstcountry="Reserved" srcintf="internal" srcintfrole="lan" dstintf="dmz" dstintfrole="undefined" sessionid=50000 action="detected" proto=6 service="HTTP" vrf=32 policyid=0 attack="test_attack" srcport=50000 dstport=80 hostname="host2" direction="N/A" attackid=32587 profile="sensor" ref="http://www.fortinet.com/ids/VID32587" user="user5" group="group1" incidentserialno=0 crscore=30 craction=8192 crlevel="high"

 

 

We checked the firewall and no admin account was logged in during the period of the events. Please note there are multiple events from Malware, Botenet, Filedownloads etc...

 

Is there a service or a different command on the Fortigate that would issue a diag log test command? Has anyone seen this before?

 

Thanks,

 

S

1 Solution
AlexC-FTNT

"test_attack" is indeed related to logs generated by "diag log test" command

The values are indeed randomized (including the IPs):


date=2024-05-13 time=15:51:25 eventtime=1715608285117030164 tz="+0200" logid="0422016400" type="utm" subtype="ips" eventtype="botnet" level="warning" vd="root" msg="Botnet C&C Communication." severity="high" srcip=168.10.199.186 srccountry="United States" dstip=224.141.85.77 dstcountry="Reserved" srcintf="ZSCALER" srcintfrole="undefined" dstintf="GE HEALTHCARE" dstintfrole="undefined" sessionid=1131176243 action="detected" srcport=49978 dstport=80 proto=6 service="HTTP" vrf=32 policyid=0 profile="sensor" direction="N/A" attack="test_botnet" attackid=12345 user="user3" group="group" ref="http://www.fortinet.com/be?bid=12345" crscore=50 craction=4 crlevel="critical"

 


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -

View solution in original post

3 REPLIES 3
AlexC-FTNT
Staff
Staff

The log above is very unlikely to be related to the "diag log test" command.

The logs generated by "diag log test" usually contain IPs "1.1.1.1" and "2.2.2.2" as source and destination - and not IPs like in your log. But to answer your question - this command is not used by any process or service on Fortigate, unless specifically configured (you can check in config: "show | grep 'log test' )


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
sioannou
Contributor

Hi @AlexC-FTNT ,

 

Thank you for your response, is there a reference somewhere for the test_attack?

 

We couldn't track anything in the documentation or FortiGuard websites in the logs. 

 

Thanks, 

 

S

AlexC-FTNT

"test_attack" is indeed related to logs generated by "diag log test" command

The values are indeed randomized (including the IPs):


date=2024-05-13 time=15:51:25 eventtime=1715608285117030164 tz="+0200" logid="0422016400" type="utm" subtype="ips" eventtype="botnet" level="warning" vd="root" msg="Botnet C&C Communication." severity="high" srcip=168.10.199.186 srccountry="United States" dstip=224.141.85.77 dstcountry="Reserved" srcintf="ZSCALER" srcintfrole="undefined" dstintf="GE HEALTHCARE" dstintfrole="undefined" sessionid=1131176243 action="detected" srcport=49978 dstport=80 proto=6 service="HTTP" vrf=32 policyid=0 profile="sensor" direction="N/A" attack="test_botnet" attackid=12345 user="user3" group="group" ref="http://www.fortinet.com/be?bid=12345" crscore=50 craction=4 crlevel="critical"

 


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors