WebFilter traffic logs are not generated

[pratik_patel]

Hi,

We are using FG 5.2.1 and FA 5.2.0. I see that web filter traffic logs are not generated. I have enabled 'set log-all-url enable'. In the version 5.0.x, I had to enable 'set extended utm log' to generate web traffic but I do not see this option anymore in the new configuration. Here is the current policy configuration. Can someone please advise what could be the issue? 

config webfilter profile
    edit "DEFAULT"
        set comment "DEFAULT"
            config override
                set ovrd-user-group ""
            end
            config ftgd-wf
                unset options
                set category-override g01 140 141
                    config filters
                        edit 83
                            set category 83
                            set action block
                        next
                        ...... more categories .....
                        next
                        edit 86
                            set category 86
                            set action block
                        next
                    end
            end
        set log-all-url enable
    next
end

Thanks, Pratik

[Christopher_McMullan]

Are any categories marked Monitor instead of Allow?

[pratik_patel]

no

Christopher McMullan_FTNT wrote:

Are any categories marked Monitor instead of Allow?

[Christopher_McMullan]

What location are you logging to - the FortiGate, or an external device?

Could you provide the output from the following configuration areas: config log {disk | fortianalyzer | syslog} setting //--depending on where you are logging to

get

end

Or else provide your configuration as a file, sanitized as need be?

[pratik_patel]

Output is redirected to fortianalyzer. Here is the configuration

config log fortianalyzer override-setting 
(override-setting) # show
config log fortianalyzer override-setting
    set override enable
    set status enable
    set server x.x.x.x
    set upload-option realtime
end

Christopher McMullan_FTNT wrote:

What location are you logging to - the FortiGate, or an external device?

Could you provide the output from the following configuration areas: config log {disk | fortianalyzer | syslog} setting //--depending on where you are logging to

get

end

Or else provide your configuration as a file, sanitized as need be?

[Christopher_McMullan]

I'm going to focus on the fact that you showed us an override setting. Was that where the setting was always configured? Do you have VDOMs in place? How do the logging settings globally compare with the per-VDOM settings?

[pratik_patel]

Yes, we have VDOMs configured and the configuration is I provided is for the VDOM used for traffic. Firewall Policies and UTM profiles are configured only in a single VDOM and not other VDOMs or globally.

Christopher McMullan_FTNT wrote:

I'm going to focus on the fact that you showed us an override setting. Was that where the setting was always configured? Do you have VDOMs in place? How do the logging settings globally compare with the per-VDOM settings?