Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
billp
Contributor

How does the " log all search keywords" feature work in FortiOS 5?

There is an option under Advanced Filter in the Webfilter Profile area in FortiOS 5 called " log all search keywords" . I have not been able to find any documentation on how this works. Anybody tried this out yet? I don' t have a FortiAnalyzer 5.0 running, so can' t run a report there. I was hoping there would be some evidence of the keywords in the Forward Traffic log file, but I could not see any evidence that it was logging keywords separately. Perhaps this is a feature that only works if you have a FAZ 5.0? Any insight on this feature would be appreciated. Thanks.

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1
7 REPLIES 7
billp
Contributor

Figured it out. I' ll answer my own post. I was looking in the wrong place. The keywords are included in the UTM Security Log section under Web Filter. It logs every search phrase entered by each user. This is a feature I' ve asked for, so perhaps someone listened to me :) It pays to part of the beta.

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1

Bill ========== Fortigate 600C 5.0.12, 111C 5.0.2 Logstash 1.4.1
whayden1
New Contributor II

How do you enable it via the CLI.  I just did a show full on my custom web filter profile with setting on and off and compared the results.  There's no changes, at least at the profile level.  Easy enough to enable via the GUI, but I need to push an FMG CLI script to enable this on 1400 firewall clusters.  Am I looking in the wrong place?

whayden1
New Contributor II

NM, I'm tired.  I have two firewall clusters open and I did the show full on the wrong firewall.

 

Answer:

config webfilter profile edit "UTM_Web_Filter_Base" config web set log-search enable <-- Yeah not really hard.  The firewall I was looking at is running older code hence the reason I just didn't see it in the first stinking place.  Off to bed. end

end

end

 

Fullmoon
Contributor III

billp wrote:
Figured it out. I' ll answer my own post. I was looking in the wrong place. The keywords are included in the UTM Security Log section under Web Filter. It logs every search phrase entered by each user. This is a feature I' ve asked for, so perhaps someone listened to me :) It pays to part of the beta.

 

hi billp, what would be the benefit of having that? pls enlighten us.

 

appreciate your feedback

 

 

Fortigate Newbie

Fortigate Newbie
nmelanson75
New Contributor

Did you ever find your answer to this, I turned it one but as I don't have FortiAnalyser I want to know if there is another way to see the report directly from the Fortigate console. 

winwizard

 Log all search keywords require SSL Deep inspection.

 Report:

 FortiVew-->Web Sites-->Search Phrases

nelis99
New Contributor II

@winwizard

 

I think this feature depends on your model. There's no FortiVew-->Web Sites-->Search Phrases screen (on a 60D @5.6.2).

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors