Why aren't the full log messages described in the FortiOS Log Reference manual?

[jefazo92]

Hi everyone, 

The full message descriptions present in the Fortigate events (e.g. Administrator X accpeted login disclaimer and logged in successfully from https(Y)) are not shown in the Log Message Reference Manual. If I go for the the log entry with the same Log ID (i.e. 32001), it only refers to successful login entry (LOG_ID_ADMIN_LOGIN_SUCC) but does not mention anything about the banner. This is really frustrating for me as I need to monitor certain events and I must how they will show in the Fortinet logs or if they will appear at all. In this case, where does acceptance of login banner appear in the log reference manual? It shows up in the GUI's Systen Events and in the log text file if I download the logs but not in the manual. 

[AEK]

Hello Jefazo

I don't know if I understand well your issue, but I could find the related log in the FortiSwitch reference manual.

Administrator logged in successfully

ID	32001
Type	Event log
Subtype	System
Severity	Notice
Message	msg=\"Administrator <user_name> logged in successfully from <IP_address>\" msg=\"Administrator <user_name> accepted login disclaimer and logged in successfully from <IP_address>\"
Meaning	An administrator logged in successfully.

Ref:  https://docs.fortinet.com/document/fortiswitch/7.4.0/fortiswitchos-log-reference/265060/system-log-m...

[jefazo92]

Thank you very much @AEK, I want to find out which logs do the messages for the events I want to log correspond to. I want to find a manual that shows me exactly the same that you have above for the FortiSwitch but for the Fortigate 100F. However, I have not found such document.

[jefazo92]

Also @AEK since the document you refer to is the FortiSwitch, I am not sure to what extent it is applicable to the Fortigate 100F :(