Fortigate not showing Deny logs

[Sozo_Admin]

Howdy all,

I am trying to view Deny traffic logs on a Fortigate 30E
(FortiGate 30Ev6.2.15 build1378 (GA)
and they are not showing up.
Via the CLI - log severity level set to Warning
Local logging

Here is the details:
CMB-FL01 # show full-configuration log memory filter
config log memory filter
set severity warning
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set filter ‘’
set filter-type include

The Fortigate is getting hammered, with alerts coming in thusly: (Sanitized)

Message meets Alert condition
date=2024-11-14 time=15:04:05 devname=CMB-FL01 devid=FGT30E5777885133 logid=“0000000013” type=“traffic” subtype=“forward” level=“notice” vd=“root” eventtime=1731621845329636171 tz=“-0700” srcip=194.264.22.254 srcport=56676 srcintf=“wan” srcintfrole=“wan” dstip=93.22.3.19 dstport=10443 dstintf=“lan” dstintfrole=“lan” sessionid=3808968 proto=6 action=“deny” policyid=0 policytype=“policy” service=“tcp/10443” dstcountry=“Canada” srccountry=“Canada” trandisp=“dnat” tranip=195.137.0.254 tranport=443 duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat=“unscanned” crscore=30 craction=131072 crlevel=“high”

Implicit Deny policy in place - set to log violation Traffic:

Firewall11209×756 28 KB

However I can find no deny logs:

Firewall21898×879 30.2 KB

Nor can I see the Implicit Deny object when trying to search logs by Policy:

firewall5509×648 86.5 KB

Firewall41914×841 40.3 KB

I don’t know if I am missing something obvious, or have configured something incorrectly.
If anyone has any advice it would be appreciated!
Thanks to any takers.
Sozo

[dingjerry_FTNT]

Run the debug flow commands to see whether your denied traffic is hitting a firewall policy with a log setting enabled.

[Sozo_Admin]

Hi dingjerry_FTNT, 

Thanks for that, I am doing so now, appreciate the suggestion. I will update with what I can find there though the implicit deny policy is in place with logging set to log all events from Warning and above it should be hitting that policy.

[funkylicious]

If the destination is the wan IP interface and not a VIP/port forward, try looking under Local Traffic.

[dingjerry_FTNT]

Agree. So @Sozo_Admin , what is your interesting traffic?  Is it a passthrough traffic or terminated on FGT?

[Sozo_Admin]

Hi again dingjerry_FTNT,

It is external attempts to access (attacks) getting denied by the Fortigate.

I am trying to view the deny logs. (Boss request)

[dingjerry_FTNT]

Do you know what denied this traffic?  Regular firewall policy or local-in policy? 

Do you know what kind of denied traffic it is?

[Sozo_Admin]

Yes as we can see from the alert "proto=6 action=“deny” policyid=0"

proto=6 is TCP, Action=Deny from policyid=0 which is the implicit deny policy

As logging is enabled as we can see from the images that I;'ve posted, I do not get why I am not able to view the deny logs for it.

[Sozo_Admin]

Howdy funkylicious,

Destination is LAN, sorry but thanks!