url="/" vs url="/SomeURL..."

[dmelamed]

Hi,

I noticed that in some of the Fortigate logs the url field is empty and in some of them it is full.

What is the reason?

[AlexC-FTNT]

Possibly because the simple domain in log is caused by traffic allowed by a policy where certificate-inspection is used, and not deep-inspection. The /.../... part is in the HTTP header, not in the URL request.

You can fine-tune this in the webfilter log:

config webfilter profile

edit name

set extended-log enable
https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/753538/webfilter-profile