log
Use the following commands to configure log settings.
log alert
Use this command to configure log based alert settings.
Syntax
config system log alert
set max-alert-count <integer>
end
|
Variable |
Description |
|---|---|
|
max-alert-count <integer> |
Maximum number of alerts supported (100 - 50000, default = 10000). |
log interface-stats
Use this command to configure log based interface statistics settings.
Syntax
config system log interface-stats
set retention-days <integer>
set sampling-interval <integer>
set status {enable | disable}
end
|
Variable |
Description |
|---|---|
|
retention-days <integer> |
The number of days that interface data are stored (0 - 365, default = 30) |
|
sampling-interval <integer> |
The interval in which interface data are received from FortiGate devices, in seconds (300 - 86400, default = 1200) |
|
status {enable | disable} |
Enable/disable interface statistics (default = enable). |
log ioc
Use this command to configure log based IoC (Indicators of Compromise) settings.
Syntax
config system log ioc
set notification {enable | disable}
set notification-throttle <integer>
set rescan-max-runner <integer>
set rescan-run-at <integer>
set rescan-status {enable | disable}
set status {enable | disable}
end
|
Variable |
Description |
|---|---|
|
notification {enable | disable} |
Enable/disable IoC notification (default = enable). |
|
notification-throttle <integer> |
Set the minute value for throttling the rate of IoC notifications (1 - 10080, default = 1440). |
|
rescan-max-runner <integer> |
Set the maximum number of concurrent IoC rescans (1 to CPU count, default = 8). |
|
rescan-run-at <integer> |
Set the hour of the day when IoC rescan runs (1 - 24, 0 = run immediately, default = 24). |
|
rescan-status {enable | disable} |
Enable/disable IoC rescan (default = enable). |
|
status {enable | disable} |
Enable/disable the IoC feature (default = enable). |
log mail-domain
Use this command to configure FortiMail domain settings.
Syntax
config system log mail-domain
edit <id>
set devices <string>
set domain <string>
set vdom <string>
end
|
Variable |
Description |
|---|---|
|
<id> |
The ID of the FortiMail domain. |
|
devices <string> |
The device IDs for domain to VDOM mapping, separated by commas (default = All_FortiMails). For example: |
|
domain <string> |
The FortiMail domain. |
|
vdom <string> |
The VDOM name that is mapping to the FortiMail domain. |
log settings
Use this command to configure settings for logs.
Syntax
config system log settings
set browse-max-logfiles <integer>
set dns-resolve-dstip {enable | disable}
set download-max-logs <integer>
set FAC-custom-field1 <string>
set FAZ-custom-field1 <string>
set FCH-custom-field1 <string>
set FCT-custom-field1 <string>
set FDD-custom-field1 <string>
set FGT-custom-field1 <string>
set FMG-custom-field1 <string>
set FML-custom-field1 <string>
set FPX-custom-field1 <string>
set FSA-custom-field1 <string>
set FWB-custom-field1 <string>
set ha-auto-migrate {enable | disable}
set import-max-logfiles <integer>
set log-file-archive-name {basic | extended}
set sync-search-timeout <integer>
config {rolling-regular | rolling-local | rolling-analyzer}
set days {fri | mon| sat | sun | thu | tue | wed}
set del-files {enable | disable}
set directory <string>
set file-size <integer>
set gzip-format {enable | disable}
set hour <integer>
set ip <ipv4_address>
set ip2 <ipv4_address>
set ip3 <ipv4_address>
set log-format {csv | native | text}
set min <integer>
set password <passwd>
set password2 <passwd>
set password3 <passwd>
set port <integer>
set port2 <integer>
set port3 <integer>
set server-type {ftp | scp | sftp}
set upload {enable | disable}
set upload-hour <integer>
set upload-mode {backup | mirror}
set upload-trigger {on-roll | on-schedule}
set username <string>
set username2 <string>
set username3 <string>
set when {daily | none | weekly}
end
end
|
Variable |
Description |
|---|---|
|
browse-max-logfiles <integer> |
Maximum number of log files for each log browse attempt, per ADOM (default = 10000). |
|
dns-resolve-stip {enable | disable} |
Enable/disable resolving destination IP by DNS (default = disable). |
|
download-max-logs <integer> |
Maximum number of logs for each log download attempt (default = 500000). |
|
FAC-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FAZ-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FCH-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FCT-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FDD-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FGT-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FMG-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FML-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FPX-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FSA-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
FWB-custom-field1 <string> |
Enter a name of the custom log field to index (character limit = 31). |
|
ha-auto-migrate {enable | disable} |
Enabled/disable automatically merging HA member's logs to HA cluster (default = disable). |
|
import-max-logfiles <integer> |
Maximum number of log files for each log import attempt (default = 10000). |
|
log-file-archive-name {basic | extended} |
Log file name format for archiving.
|
|
sync-search-timeout <integer> |
The maximum amount of time that a log search session can run in synchronous mode, in seconds (1 - 86400, default = 60). |
|
Variables for |
|
|
days {fri | mon| sat | sun | thu | tue | wed} |
Log files rolling schedule (days of the week). When |
|
del-files {enable | disable} |
Enable/disable log file deletion after uploading (default = disable). |
|
directory <string> |
The upload server directory (character limit = 127). |
|
file-size <integer> |
Roll log files when they reach this size, in megabytes (10 - 1000, default = 200). |
|
gzip-format {enable | disable} |
Enable/disable compression of uploaded log files (default = disable). |
|
hour <integer> |
The hour of the day that log files are rolled (0 - 23, default = 0). |
|
ip <ipv4_address> ip2 <ipv4_address> ip3 <ipv4_address> |
Upload server IPv4 addresses. Configure up to three servers. |
|
log-format {csv | native | text} |
Format of uploaded log files:
|
|
min <integer> |
The minute of the hour that log files are rolled (0 - 59, default = 0). |
|
password <passwd> password2 <passwd> password3 <passwd> |
Upload server log in passwords (character limit = 128). |
|
port <integer> port2 <integer> port3 <integer> |
Upload server IP port number. |
|
server-type {ftp | scp | sftp} |
Upload server type (default = ftp). |
|
upload {enable | disable} |
Enable/disable log file uploads (default = disable). |
|
upload-hour <integer> |
The hour of the day that log files are uploaded (0 - 23, default = 0). |
|
upload-mode {backup | mirror} |
Configure upload mode with multiple servers. Servers are tried then used one after the other upon failure to connect.
|
|
upload-trigger {on-roll | on-schedule} |
Event triggering log files upload:
|
|
username <string> username2 <string> username3 <string> |
Upload server log in usernames (character limit = 35). |
|
when {daily | none | weekly} |
Roll log files periodically:
|