Tailing the Log (execute log display / diagnose log tail ) in FortiOS

[BSeklecki_GE]

POSIX People:

 Is there a way to set a filter and tail the log file in real-time?

 (GNU/Linux equivalent of "tail -f [input-pipe]  | egrep [regExp]" ) ?

FortiDB documentation has a "diagnose log tail" but FortiOS on FortiGate only has "execute log display" 

Maybe some sort of "fnsysctl" to accomplish this using the raw underlying POSIX (MySQL database query or whatever the underlying FortiOS is using to store the events/logs)

Basically I need to replicate the behavior see a real-time display that Cisco's "Terminal Monitor" or "logging Console Debug" 

When the firewall is standalone BEFORE FortiAnalyizer and connection to a Syslog server.

Sitting there clicking on the GUI waiting for HTML5 is a epic waste of time, because they haven't implemented real time update/refresh.

Trying to accomplish this with a FOR loop of "execute log display" in combination with "execute log filter view-lines [X]" is problematic / error-prone.

I hope someone knows already, and my Google foo is low; otherwise the FortiGate firewall is an $8000 + Linux box where you cant tail a log file... >:}

[AEK]

As per my knowledge only diag commands show in real time.

Which logs you need to see in real time? Traffic logs? System logs? ...

[BSeklecki_GE]

If I were doing it asynchronous, it would be : "execute log filter device"

 or

  "execute log filter field subtype system"

I want to watch power supply events, interface up/down state changes, SFP inserts and removals, power supply status changes, etc. etc.

[AEK]

Try this one:

diagnose fortiview result event-log

[BSeklecki_GE]

Not a valid syntax on a VDOM-enabled 100F.  In fact, there are no references to "fortivew" in the "sh ful" output.

Anyone else?

[AEK]

It seems command "diagnose fortiview result event-log" is available on 7.2.x and 7.4.x only.

[BSeklecki_GE]

It is not functional for me on V7.2.6 [ "FGT_100F-v7.2.6.F-build1575-FORTINET.out" ]

Maybe Fortinet could add a feature that doesn't depend on FortiView function/feature ? Might as well since every supported OS on every device will need to be patched/rebuilt this week anyway to address CVEs.

~BAS