>I try to search -> purging deleted, but the searching result is empty (0 log record).
This is correct as the search is an implicit AND not OR i.e. your search will look for logs containing purging AND deleted. Additional logic to search using OR is not currently supported.
There are other events which will trigger this ID. Log Type 10003 is a general "Entry Deleted" log and can be triggered by deleting a user (manually) or a FortiToken for example.
If this is not adequate for your needs, please raise a feature request via your Fortinet Account Manager.
Dr. Carl Windsor
Field Chief Technology Officer