How may I select which specific events I want to log in a Fortigate?

[jefazo92]

Hi everyone,

I want to be able to choose specific system events (e. g. failed login attempts, policy changes, etc.) to be logged. I have been reading the admin manual but have not found how I may achieve this. Within Log & Report - > Log Settings - > Global settings, there are only log categories (e.g. System activity events) but no explanation as to what specific events they refer to. Would you mind telling me how I may choose the events I want to log?

[ozkanaltas]

Hi @jefazo92 ,

If you want to filter the log before sending the syslog you can review this document. If you want to filter the logs directly on FortiGate, I know there is no such feature.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-syslog-filters-on-to-send-only-speci...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-syslog-free-style-filters/ta-p/20460...