Fortiweb x-forwarded-for IP logging in attack logs

[julioo]

Hi,

I've configured our Fortiwebs to process the x-forwarded-for header to log the actual client IP. In the acccess log this is logged and we can now have a "original source" column with the actual IP, the geo location etc. However in the attack logs, this column does not exist, nor is the x-fowarded-for header logged. Does anyone know how to turn this on for the attack logs?

[AEK]

Hi Julioo

Your message is tagged "FortiGate". Do you mean that you enabled x-forward-for at FortiGate level and then it is seen at FortiWeb level?