Fortigate Logging Problem

[Magroll73]

Hi, I have an strage error with logging.

I have two Test VMs (10.244.15.41 and 10.244.14.109) in AWS segmented by an Fortigate 7.2.2 

• First I did an SSH connection from 10.244.15.41 to 10.244.14.109
• As next step I ping 8.8.8.8 from 10.244.14.109

But the Fortigate Logging shows the connection in an wrong order with 3 Minutes delay!

Date Time	Source IP	Destination IP	Protocol	Action	Rule
2022/11/09 09:44:47	10.244.15.41	10.244.14.109	SSH	ACCEPT	AWS-Internal
2022/11/09 09:41:38	10.244.14.109	8.8.8.8	PING	ACCEPT	AWS-External

Has anyone an explanation for this?

ThX Mag

[distillednetwork · Accepted solution]

Unless you change the setting in the policies, the data is logged when the session closes.  So with ICMP, it is opened and then closed right away.  An SSH will stay in the session list longer and will be added to the forward traffic logs after the session ends.