The " duration" value in log files

[MetaleX]

Hello, there is something I don' t understand with my log files. It is the " duration" value. As an example let' s consider this line: WTsyslog[2007-02-06 12:46:17 ip=Z.Z.Z.Z pri=5] id=firewall time=" 2007-02-06 12:46:18" fw=FGT400SomeSerial pri=5 SN=AnotherSerial duration=163 rule=83 policyid=83 proto=443/tcp service=443/tcp status=accept src=Y.Y.Y.Y srcname=Y.Y.Y.Y dst=X.X.X.X dstname=X.X.X.X src_int=port2 dst_int=port1 sent=1180 rcvd=1052 sent_pkt=21 rcvd_pkt=20 src_port=53092 dst_port=443 vpn=n/a tran_ip=W.W.W.W tran_port=443 dir_disp=org tran_disp=noop It has been extracted from a log file of a WebTrends syslog, and comes form a FG400 in WELF format. This connection was done on purpose over 5 seconds long, but the " duration" value is 163. As it is supposed to be the duration of the session in seconds, how can the log say it was more than two minutes long if I closed it after 5 seconds? Is this value specified in another time unit (cents of seconds)? The only stable value I saw in the log is for denied connections: duration=0. The rest is erratic but mostly over 130. Thanks in advance, Alex

[jtatum1]

I am having the same question, and not finding much information on what the unit of time is.  This has been open since 2007 and no response from Fortinet?

[Debbie_FTNT]

Hey jtatum1,

we're still catching up a lot; the Forums were changed to Community last November, and we have a team in place to keep a better eye on things.

As for the question in this thread:
- the 'duration' is in seconds

- FortiGate generates the log after a session is removed from its session table

-> in newer firmware versions it also generates interim traffic logs every two minutes for ongoing sessions

-> a session is closed (and the log written) if it times out, an RST packet or FIN/ACK exchange is observed, the session is cleared manually, and a few other reasons (such as a user authentication timing out)

Let me know if you have more questions on the 'duration' field :)