If I Put UTM in the firewall policy will it collect logs?

[Network_Engineer]

Or where can I get the logs output?

[jintrah_FTNT]

Hi,

In the firewall policy, you may enabled UTM as needed to record security events by default. There is also an option to log all sessions,

The logs can be viewed under Log & Report section provided logging to memory/disk/FortiAnalyzer have been enabled( for ref on memory logging, Technical Note: How to configure logging in memory... - Fortinet Community). 

best regards,

Jin

[Network_Engineer]

Hi,

In your screenshot, where is the option to enable UTM?

What is the difference between UTM and security events? 

[iskandar_lie · Accepted solution]

Hi, 

Under the security profile, start from Antivirus, and so fort - they are UTM. You can enable it by pressing the slide. 

this is to clarify you question about UTM and Sec. events :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-between-Security-Events-and-All...

Regards,

Lie

[Rathan_FTNT]

Hello,

Also, you can set the log severity to information to view almost all logs 

The command in CLI will be as below

config log memory filter
set severity information 
end 

Similarly, for analyzer, you can replace "memory" with "analyzer"  for sys log "syslog"

Refer to the below log severity levels 

https://docs2.fortinet.com/document/fortimanager/6.0.10/log-message-reference/547625/priority-levels