Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    Home FortiADC 5.3.0 CLI Reference
    5.3.0
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.1.4
    7.1.3
    7.1.2
    7.1.1
    7.1.0
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.6
    6.1.5
    6.1.4
    6.1.3
    6.1.2
    6.1.1
    6.1.0
    6.0.2
    6.0.1
    6.0.0
    5.4.5
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.3.0
    4.8.1
    4.7.0

    config log setting local

    config log setting local

    Use this command to configure basic log settings.

    The local log is a datastore hosted on the FortiADC system.

    Typically, you use the local log to capture information about system health and system administration activities. We recommend that you use local logging during evaluation and verification of your initial deployment, and then configure remote logging to send logs to a log management repository where they can be stored long term and analyzed using preferred analytic tools.

    Local log disk settings are configurable. You can select a subset of system events, traffic, and security logs.

    Before you begin:

    • You must have read-write permission for log settings.

    Syntax

    config log setting local

    set attack-log-cached-lines {0|100|500|800|1000|2000|5000|10000}

    set attack-log-category {synflood ipreputation waf geo}

    set attack-log-status {enable|disable}

    set disk-full {overwrite | nolog}

    set event-log-cached-lines {0|100|500|800|1000|2000|5000|10000}

    set event-log-category {admin configuration fw glb health-check llb slb system user}

    set event-log-status {enable|disable}

    set loglevel {alert | critical | debug | emerge | error | information | notification | warning}

    set rate_limit <integer>

    set rotation-size <integer>

    set status {enable|disable}

    set traffic-log-cached-lines {0|100|500|800|1000|2000|5000|10000}

    set traffic-log-category {slb | dns | llb}

    set traffic-log-status {enable|disable}

    set script-log-status {enable|disable}

    set script-log-category {slb}

    end

    attack-log-cached-lines

    Limit the number of logs that are cached. The default is 0 (disabled). Valid multiples are 100, 500, 800, 1000, 2000, 5000, 10000. If 0, every generated log is written to disk immediately. If 1000, logs are written to disk in batches of 1000.

    attack-log-category
    • synflood— SYN flood protection logs.
    • ipreputation— IP Reputation logs.
    • waf—WAF logs.
    • geo—Geo logs.

    attack-log-status

    Enable/disable logging for the category.

    disk-full

    Specify log behavior when the maximum disk space for local logs (30% of total disk space) is reached:

    • overwrite—Continue logging. Overwrite the earliest logs.
    • nolog—Stop logging.

    event-log-cached-lines

    Limit the number of logs that are cached. The default is 0 (disabled). Valid multiples are 100, 500, 800, 1000, 2000, 5000, 10000. If 0, every generated log is written to disk immediately. If 1000, logs are written to disk in batches of 1000.

    event-log-category

    		Select the types of events to collect in the local log:

    • Configuration—Configuration changes.
    • Admin—Administrator actions.
    • System—System operations, warnings, and errors.
    • User—Authentication results logs.
    • Health Check—Health check results and client certificate validation check results.
    • SLB—Notifications, such as connection limit reached.
    • LLB—Notifications, such as bandwidth thresholds reached.
    • GLB—Notifications, such as the status of associated local SLB and virtual servers.
    • Firewall—Notifications for the "firewall" module, such as SNAT source IP pool is using all of its addresses.

    event-log-status

    Enable/disable logging for the category.

    loglevel

    Specify the lowest severity for which alerts are sent:

    • Emergency—The system has become unstable.
    • Alert—Immediate action is required.
    • Critical—Functionality is affected.
    • Error—An error condition exists and functionality could be affected.
    • Warning—Functionality might be affected.
    • Notification—Information about normal events.
    • Information—General information about system operations.
    • Debug—Detailed information about the system that can be used to troubleshoot unexpected behavior.

    For example, if you select error, the system sends alerts with level Error, Critical, Alert, and Emergency. If you select alert, the system sends alerts with level Alert and Emergency.

    rate_limit

    Rate limit logging (logs/second). The default is 0 (disabled).

    rotation-size

    Maximum size for a local log file. The default is 200 MB. When the current log file reaches this size, a new file is created.

    status

    Enable/disable local logging.

    traffic-log-cached-lines

    Limit the number of logs that are cached. The default is 0 (disabled). Valid multiples are 100, 500, 800, 1000, 2000, 5000, 10000. If 0, every generated log is written to disk immediately. If 1000, logs are written to disk in batches of 1000.

    traffic-log-category
    • SLB—Server Load Balancing traffic logs related to sessions and throughput.
    • GLB—Global Load Balancing traffic logs related to DNS requests.
    • LLB—Link Load Balancing traffic logs related to sessions and throughput.

    traffic-log-status

    Enable/disable logging for the category.

    script-log-status

    Enable/disable script log.

    script-log-category

    Set script log category.

    Example

    FortiADC-VM (root) # get log setting local

    status : enable

    rotation-size : 199

    disk-full : overwrite

    loglevel : information

    event-log-status : enable

    event-log-category : configuration admin health_check system user slb llb glb fw

    traffic-log-status : enable

    traffic-log-category : slb dns

    attack-log-status : enable

    attack-log-category : synflood ipreputation waf geo

    script-log-status : enable

    script-log-category : slb

    event-log-cached-lines : 0

    traffic-log-cached-lines : 0

    attack-log-cached-lines : 0

    rate_limit : 0

    Previous
    Next

    config log setting local

    config log setting local

    Use this command to configure basic log settings.

    The local log is a datastore hosted on the FortiADC system.

    Typically, you use the local log to capture information about system health and system administration activities. We recommend that you use local logging during evaluation and verification of your initial deployment, and then configure remote logging to send logs to a log management repository where they can be stored long term and analyzed using preferred analytic tools.

    Local log disk settings are configurable. You can select a subset of system events, traffic, and security logs.

    Before you begin:

    • You must have read-write permission for log settings.

    Syntax

    config log setting local

    set attack-log-cached-lines {0|100|500|800|1000|2000|5000|10000}

    set attack-log-category {synflood ipreputation waf geo}

    set attack-log-status {enable|disable}

    set disk-full {overwrite | nolog}

    set event-log-cached-lines {0|100|500|800|1000|2000|5000|10000}

    set event-log-category {admin configuration fw glb health-check llb slb system user}

    set event-log-status {enable|disable}

    set loglevel {alert | critical | debug | emerge | error | information | notification | warning}

    set rate_limit <integer>

    set rotation-size <integer>

    set status {enable|disable}

    set traffic-log-cached-lines {0|100|500|800|1000|2000|5000|10000}

    set traffic-log-category {slb | dns | llb}

    set traffic-log-status {enable|disable}

    set script-log-status {enable|disable}

    set script-log-category {slb}

    end

    attack-log-cached-lines

    Limit the number of logs that are cached. The default is 0 (disabled). Valid multiples are 100, 500, 800, 1000, 2000, 5000, 10000. If 0, every generated log is written to disk immediately. If 1000, logs are written to disk in batches of 1000.

    attack-log-category
    • synflood— SYN flood protection logs.
    • ipreputation— IP Reputation logs.
    • waf—WAF logs.
    • geo—Geo logs.

    attack-log-status

    Enable/disable logging for the category.

    disk-full

    Specify log behavior when the maximum disk space for local logs (30% of total disk space) is reached:

    • overwrite—Continue logging. Overwrite the earliest logs.
    • nolog—Stop logging.

    event-log-cached-lines

    Limit the number of logs that are cached. The default is 0 (disabled). Valid multiples are 100, 500, 800, 1000, 2000, 5000, 10000. If 0, every generated log is written to disk immediately. If 1000, logs are written to disk in batches of 1000.

    event-log-category

    		Select the types of events to collect in the local log:

    • Configuration—Configuration changes.
    • Admin—Administrator actions.
    • System—System operations, warnings, and errors.
    • User—Authentication results logs.
    • Health Check—Health check results and client certificate validation check results.
    • SLB—Notifications, such as connection limit reached.
    • LLB—Notifications, such as bandwidth thresholds reached.
    • GLB—Notifications, such as the status of associated local SLB and virtual servers.
    • Firewall—Notifications for the "firewall" module, such as SNAT source IP pool is using all of its addresses.

    event-log-status

    Enable/disable logging for the category.

    loglevel

    Specify the lowest severity for which alerts are sent:

    • Emergency—The system has become unstable.
    • Alert—Immediate action is required.
    • Critical—Functionality is affected.
    • Error—An error condition exists and functionality could be affected.
    • Warning—Functionality might be affected.
    • Notification—Information about normal events.
    • Information—General information about system operations.
    • Debug—Detailed information about the system that can be used to troubleshoot unexpected behavior.

    For example, if you select error, the system sends alerts with level Error, Critical, Alert, and Emergency. If you select alert, the system sends alerts with level Alert and Emergency.

    rate_limit

    Rate limit logging (logs/second). The default is 0 (disabled).

    rotation-size

    Maximum size for a local log file. The default is 200 MB. When the current log file reaches this size, a new file is created.

    status

    Enable/disable local logging.

    traffic-log-cached-lines

    Limit the number of logs that are cached. The default is 0 (disabled). Valid multiples are 100, 500, 800, 1000, 2000, 5000, 10000. If 0, every generated log is written to disk immediately. If 1000, logs are written to disk in batches of 1000.

    traffic-log-category
    • SLB—Server Load Balancing traffic logs related to sessions and throughput.
    • GLB—Global Load Balancing traffic logs related to DNS requests.
    • LLB—Link Load Balancing traffic logs related to sessions and throughput.

    traffic-log-status

    Enable/disable logging for the category.

    script-log-status

    Enable/disable script log.

    script-log-category

    Set script log category.

    Example

    FortiADC-VM (root) # get log setting local

    status : enable

    rotation-size : 199

    disk-full : overwrite

    loglevel : information

    event-log-status : enable

    event-log-category : configuration admin health_check system user slb llb glb fw

    traffic-log-status : enable

    traffic-log-category : slb dns

    attack-log-status : enable

    attack-log-category : synflood ipreputation waf geo

    script-log-status : enable

    script-log-category : slb

    event-log-cached-lines : 0

    traffic-log-cached-lines : 0

    attack-log-cached-lines : 0

    rate_limit : 0

    Previous
    Next