Friends,
Why is it that I see policy UUID in some of the logs while it is absent in others?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
You can enable UUID logging or lack of. It's very help if you are tacking items by UUID. I use it a lot btw.
global options
set log-uuid policy-only
Ken
PCNSE
NSE
StrongSwan
Hi Ken,
Actually, I could see some unusual logs in my Logs & Reports section. There is a policy which is disabled for logging completely, yet I see that there are huge logs generated through it. I am assuming that these logs are junk. When I right click the policy after enabling it, and select "matching logs" I can only see the logs with UUID associated to them.
I am pretty new to Fortigates :)
There is a policy which is disabled for logging completely, yet I see that there are huge logs generated through it.
Explain? How could that be?
If you have logging enable for category traffic, & traffic that matches that fwpolicy , you will send a log message. If you have UUID enable for policy, the log message is tagged with the UUID. There's no way you can have it disable and still see logging imho & I don't know what you mean by "junk logs".
Login thru ssh or jsconsole and find the firrewallpolicy and look for the log traffic set command? What is it set for?
example
show full firewall policy 7 | grep log
set logtraffic all
set logtraffic-start disable
Ken
PCNSE
NSE
StrongSwan
what does a full show for that policy
e.g
show full firewall policy 53 | grep log
ken
PCNSE
NSE
StrongSwan
Another thing, is the traffic you are seeing recent or is it historical from before logging was disabled (if that was the case)
Mike Pruett
Hi Mike,
I upgraded Fortigate from 5.2.8 to 5.2.9 and I cannot see policy ID 53 anymore. But similar problem exists with another policy. I am able to see real-time logs from this policy which I created yesterday and disabled logging. Still I see huge logs in my Logs & Reports. These are fresh logs.
show full firewall policy 71 | grep log set logtraffic disable set logtraffic-start disable
Regards,
Faizan
Hmmm.
Are you running HA pairs?
Can you do the following from the cli;
execute log filter cat 0
execute log filter field policyid 71
execute log filter field vd <0> INSERT THE VDOM.index number if your in a multi-vdom mode ( id 0 == root btw )
then
execute log display
Do you have logs on the screen? keep in mind in a master/standby cluster the logs will be on the active cluster unit for that vdom.
Your situation does not seem normal and something is over looked.
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.