Technical Tip: Displaying logs via FortiGate's CLI (2024)

Description

A FortiGate is able to display by both the GUI and via CLI. This article explains how to display logs through CLI.

Scope

FortiGate.

Solution

To display log records use command:

But it would be better to define a filter giving the logs you need and that the command above should return.

Set different types of log filter options, the number of results and from what point in the collected logs it is to start displaying.

First steps might be to check current filter settings, or reset/clear those:

Next step is to set source of the logs:

Until FortiOS 6.2 listing was:

Example output (can be different if disk logging is available):
Available devices:

Next step is to choose category of logs to display:

Available categories in FortiOS 6.2:

The default log filter configuration looks like below.

Note.

The following outputs might look different on different FortiGate models depending on the hardware/VM, or w/o internal disk storage:

# show full-configuration log memory filter
config log memory filter
set severity information
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set dns enable
set ssh enable
set ssl enable
set cifs enable
set filter ''
set filter-type include
end

FortiOS 6.0:

# show full-configuration log memory filter
config log memory filter
set severity information
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set dns enable
set ssh enable
set filter ''
set filter-type include
end

FortiOS 5.6:

# show full-configuration log memory filter
config log memory filter
set severity warning
set forward-traffic enable
set local-traffic disable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set dns enable
set filter ''
set filter-type include
end

FortiOS 5.4:
The log filter a FortiGate has the following options:

# show full-configuration log memory filter
config log memory filter
set severity information
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set filter ''
set filter-type include
end

For example, by using the following log filters FortiGate will display all utm-webfilter logs with the destination ip address 40.85.78.63:

# execute log filter category 3
# execute log filter field dstip 40.85.78.63
# execute log display
1 logs found.
1 logs returned.1: date=2019-09-14 time=14:52:36 logid="0317013312" type="utm" subtype="webfilter" eventtype="ftgd_allow" level="notice" vd="root" eventtime=1568465556531146383 tz="+0200" policyid=1 sessionid=3190297 srcip=172.16.190.216 srcport=10806 srcintf="port3" srcintfrole="undefined" dstip=40.85.78.63 dstport=443 dstintf="port1" dstintfrole="undefined" proto=6 service="HTTPS" hostname="wdcp.microsoft.com" profile="monitor-all" action="passthrough" reqtype="direct" url="/" sentbyte=197 rcvdbyte=3787 direction="outgoing" msg="URL belongs to an allowed category in policy" method="domain" cat=52 catdesc="Information Technology"

Alternatively, by using the following log filters FortiGate will display all utm-webfilter logs with destination ip address 40.85.78.63 that are not from September 13, 2019:

# execute log filter free-style "(date 2019-09-13 not) and (dstip 40.85.78.63)"

1: date=2019-09-14 time=14:52:36 logid="0317013312" type="utm" subtype="webfilter" eventtype="ftgd_allow" level="notice" vd="root" eventtime=1568465556531146383 tz="+0200" policyid=1 sessionid=3190297 srcip=172.16.190.216 srcport=10806 srcintf="port3" srcintfrole="undefined" dstip=40.85.78.63 dstport=443 dstintf="port1" dstintfrole="undefined" proto=6 service="HTTPS" hostname="wdcp.microsoft.com" profile="monitor-all" action="passthrough" reqtype="direct" url="/" sentbyte=197 rcvdbyte=3787 direction="outgoing" msg="URL belongs to an allowed category in policy" method="domain" cat=52 catdesc="Information Technology"

Other examples of using the free-style log filter:

# execute log filter free-style "srcip 172.16.1.1"
# execute log filter free-style "(srcip 172.16.1.1) or (dstip 172.16.1.2)"
# execute log filter free-style "(srcip 172.16.1.1) and (dstip 172.16.1.2)"
# execute log filter free-style "((srcip 172.16.1.1) or (dstip 172.16.1.2)) and (dstport 80 443 50-60)"

Also, it is possible to configure the following log filter commands:

# execute log filter
category Category.
device Device to get log from.
dump Dump current filter settings.
field Filter by field. Specify from 1to 5 values value1 [value2 ... value5] [not]
Use not to reverse the condition.
Each value can be an individual value or a value range.
For value range, "-" is used to separate two values.
For example, 2013/06/13-2013/06/14 is for a date range from Jun 13, 2013 to Jun 14, 2013

free-style Filter by free-style expression.
ha-member HA member.
max-checklines Maximum number of lines to check (maximum number of log entries that will be checked, 0 means all will be checked)
reset Reset filter.
start-line Start line to display (the log entry to start displaying from; so if set to 10, the 10th entry onward will be displayed)
view-lines Lines per view (the number of log entries that will be displayed, default 10)

Also, it is possible to work with the logs - roll, backup, delete local logs, list log details like occupied space/date/time of the log and more:

# execute log
backup Backup.
delete Delete local logs of one category.
delete-all Delete all local logs.
detail Display UTM log entries for a particular traffic log.
display Display filtered log entries.
filter Set filters we discused here.
flush-cache Write disk log cache of current category to disk in compressed format.
flush-cache-all Write disk log cache of all categories to disk in compressed format.
fortianalyzer FortiAnalyzer.
fortianalyzer-cloud FortiAnalyzer-cloud.
fortiguard FortiGuard.
list List current and rolled log files info.
raw-backup Raw-backup.
roll Roll log files now.

Related articles: