No Antivirus logs

[Diabolicus23]

Hi,

it seems that my FortiGate does not log antivirus events...

I've tried to download EICAR files and it is correctly blocked with antivirus replacement message but in the log section the antivirus subsection is empty.

I've also tried to give the "set extended-utm-log enable" option to the antivirus profile but nothing has changed.

Idea?

Thanks

[Christopher_McMullan]

Just bringing the whole context to bear, you also need to make sure the following settings are enabled:

-within the A/V profile, you need to enable virus logging:

config antivirus profile

edit <profile_name>

set av-virus-log enable

end

-the firewall policy the profile is applied to cannot have logging disabled:

config firewall policy

edit <int>

set logtraffic {all | utm} //--but not 'set logtraffic disable'

end

-logging to at least one destination needs to be enabled:

config log {memory | disk | fortianalyzer {1 | 2 | 3} | syslogd {1 | 2 | 3} | webtrends | fortiguard} setting

set status enable

end

-the destination cannot have those events filtered out:

config log {memory | disk | fortianalyzer {1 | 2 | 3} | syslogd {1 | 2 | 3} | webtrends | fortiguard} filter

set blocked enable //--but not 'set blocked disable'

end

I hope this helps! Check those other parameters, and make sure you logged out and logged back into the GUI after generating the log event, in order for A/V events to have their section appear under Log & Reports.

If you still can't see the log events, it may be worth checking in the CLI. We can fill in the commands for that if it comes to it.

[Diabolicus23]

Hi Chris,

I've checked and all the settings/options are as they should be.

Another info: I've the same exact antivirus profile in a 300D with FortiOS 5.0.9 and antivirus logs appear; in 500D with 5.0.10 they don't.

[Christopher_McMullan]

-What destination are you logging to?

-Do any other UTM logs appear?

Could you run 'get sys stat | grep Log' and see what the status of the Log Hard Disk appears as, if you're logging to disk, or else using store-and-forward to transmit your logs to a remote server?

Two other things to check:

1. Debug the logging daemon

-and-

2. Check the logs through the CLI

1. Debugging

diag debug reset

diag debug enable

diag debug application miglogd -1

<generate the log event by downloading the EICAR file, then...>

diag debug reset

diag debug disable

2. Viewing logs via the CLI

-Filter for A/V logs

McFortiGate # exec log filter category Available categories: 0: traffic 1: event 2: utm-virus 3: utm-webfilter 4: utm-ips 5: utm-spam 6: contentlog 7: anomaly 8: voip 9: utm-dlp 10: utm-app-ctrl 11: netscan

exec log filter category 2

exec log display

[Luis_gnr]

I have recently had the same issue and bumped with this forum while trying to find an answer. Finally, I found that:

1) FortiClient (not FortiGate) Web filter was detecting this first, so it never reached the FortiGate

2) Once I disabled FortiClient Web filter, Fortigate detected this virus through web filter, so no antivirus logs were generated, only Web filter

Once I disabled both FortiClient Web filter, and the filter in the policy of the FortiGate, I was able to see the logs for eicar in the antivirus logs.

[emmanuelgonzalez914]

 I reproduced my environment:

1- If you have enabled web filter or application control you can not view the log on anti-virus. 

2- Once you only enable anti-virus without web filter and Application Control the Log was there in the Security events for Anti Virus.

Note: My policy was implemented with flow-based, and deep inspection.  Ensure your anti-virus profile is as your firewall policy, in my case, it is flow-based.