How does the " log all search keywords" feature work in FortiOS 5?

[billp]

There is an option under Advanced Filter in the Webfilter Profile area in FortiOS 5 called " log all search keywords" . I have not been able to find any documentation on how this works. Anybody tried this out yet? I don' t have a FortiAnalyzer 5.0 running, so can' t run a report there. I was hoping there would be some evidence of the keywords in the Forward Traffic log file, but I could not see any evidence that it was logging keywords separately. Perhaps this is a feature that only works if you have a FAZ 5.0? Any insight on this feature would be appreciated. Thanks.

[billp]

Figured it out. I' ll answer my own post. I was looking in the wrong place. The keywords are included in the UTM Security Log section under Web Filter. It logs every search phrase entered by each user. This is a feature I' ve asked for, so perhaps someone listened to me :) It pays to part of the beta.

[whayden1]

How do you enable it via the CLI.  I just did a show full on my custom web filter profile with setting on and off and compared the results.  There's no changes, at least at the profile level.  Easy enough to enable via the GUI, but I need to push an FMG CLI script to enable this on 1400 firewall clusters.  Am I looking in the wrong place?

[whayden1]

NM, I'm tired.  I have two firewall clusters open and I did the show full on the wrong firewall.

Answer:

config webfilter profile edit "UTM_Web_Filter_Base" config web set log-search enable <-- Yeah not really hard.  The firewall I was looking at is running older code hence the reason I just didn't see it in the first stinking place.  Off to bed. end

end

end

[Fullmoon]

billp wrote:
Figured it out. I' ll answer my own post. I was looking in the wrong place. The keywords are included in the UTM Security Log section under Web Filter. It logs every search phrase entered by each user. This is a feature I' ve asked for, so perhaps someone listened to me :) It pays to part of the beta.

hi billp, what would be the benefit of having that? pls enlighten us.

appreciate your feedback

[nmelanson75]

Did you ever find your answer to this, I turned it one but as I don't have FortiAnalyser I want to know if there is another way to see the report directly from the Fortigate console. 

[winwizard]

 Log all search keywords require SSL Deep inspection.

 Report:

 FortiVew-->Web Sites-->Search Phrases

[nelis99]

@winwizard

I think this feature depends on your model. There's no FortiVew-->Web Sites-->Search Phrases screen (on a 60D @5.6.2).