Filtering messages

You can apply filters to the message list. Filters are not case-sensitive by default. If available, select Tools > Case Sensitive Search to create case-sensitive filters.

Filtering messages using filters in the toolbar

1. Go to the view you want.

   Filter mode search	In the Add Filter box, click the plus icon and select a filter from the dropdown list. Then select =, !=, >, or < and type a value for the filter. Click Apply to add the filter. Click the plus icon again to add another filter. It will be added with an AND relationship to the previous filter. You can click the operator in the Add Filter box to toggle between AND and OR, or click a filter to edit the value. When adding a filter, only displayed columns are available in the dropdown list.
   Switching between filter mode search and text mode search	At the right end of the Add Filter box, click the Switch to text mode icon to switch to a text mode search. When in text mode search, click the Switch to filter mode icon to switch to a filter mode search.
   Text mode search	In text mode search, enter the search criteria (log field names and values).
   Search operators and syntax	If available, click the help icon at the right end of the Add Filter box to view search operators and syntax. See also Filter search operators and syntax.
   CLI string “freestyle” search	Searches the string within the indexed fields configured using the CLI command: config ts-index-field. For example, if the indexed fields have been configured using these CLI commands: config system sql config ts-index-field edit "FGT-traffic" set value "app,dstip,proto,service,srcip,user,utmaction" next end end Then if you type “Skype” in the Add Filter box, FortiAnalyzer searches for “Skype” within these indexed fields: app,dstip,proto,service,srcip,user and utmaction. You can combine freestyle search with other search methods, for example: Skype user=David.

2. In the toolbar, make other selections such as devices, time period, which columns to display, etc.

   UUID logging must be enabled in FortiGate/FortiOS to filter FortiGate traffic logs by object name, including Source Object and Destination Object. See the FortiGate/FortiOS Administration Guide for more information about UUID logging.

Filtering messages using the right-click menu

In the log message table view, right-click an entry to select a filter criteria from the menu. Depending on the column in which your cursor is placed when you right-click, Log View uses the column value as the filter criteria. This context-sensitive filter is only available for certain columns.

You can perform the following filter actions from the right-click menu:

• Add a filter entry with an AND condition, such as AND event_type=traffic

• Add a filter entry with an AND negate condition, such as AND event_type!=traffic

• Add a filter entry with an OR condition, such as OR event_type=traffic

• Add a filter entry with an OR negate condition, such as OR event_type!=traffic

• Replace all filters with the selected entry, such as event_type=utm

• Replace all filters with the selected negate, such as event_type!=utm

If no filter is used before right-click filtering, the new filter will be added no matter which option is selected in the right-click menu.

To see log field name of a filter/column, right-click the column of a log entry and select a context-sensitive filter. The Add Filter box shows log field name. Context-sensitive filters are available for each log field in the log details pane. See Viewing message details.

Filtering messages using smart action filters

For Log View windows that have an Action column, the Action column displays smart information according to policy (log field action) and utmaction (UTM profile action).

The Action column displays a green checkmark Accept icon when both policy and UTM profile allow the traffic to pass through, that is, both the log field action and UTM profile action specify allow to this traffic.

The Action column displays a red X Deny icon and the reason when either the log field action or UTM profile action deny the traffic.

If the traffic is denied due to policy, the deny reason is based on the policy log field action.

If the traffic is denied due to UTM profile, the deny reason is based on the FortiView threattype from craction. craction shows which type of threat triggered the UTM action. The threattype, craction, and crscore fields are configured in FortiGate in Log & Report. For more information, see the FortiOS - Log Message Reference in the Fortinet Document Library.

A filter applied to the Action column is always a smart action filter.

The smart action filter uses the FortiGate UTM profile to determine what the Action column displays. If the FortiGate UTM profile has set an action to allow, then the Action column will display that line with a green Accept icon, even if the craction field defines that traffic as a threat. The green Accept icon does not display any explanation. In the scenario where the craction field defines the traffic as a threat but the FortiGate UTM profile has set an action to allow, that line in the Log View Action column displays a green Accept icon. The green Accept icon does not display any explanation.

Filter search operators and syntax

Operators or symbols	Syntax
And	Find log entries containing all the search terms. Connect the terms with a space character, or “and”. Examples: user=henry group=sales user=henry and group=sales
Or	Find log entries containing any of the search terms. Separate the terms with “or” or a comma “,”. Examples: user=henry or srcip=10.1.0.15 user=henry,linda
Not	Find log entries that do NOT contain the search terms. Add “-” before the field name. Example: -user=henry
>, <	Find log entries greater than or less than a value, or within a range. This operator only applies to integer fields. Example: policyid>1 and policyid<10
IP subnet, range, subnet list search	Find log entries within a certain IP subnet, IP range, subnet list, or subnet group. Examples: srcip=192.168.1.0/24 srcip=10.1.0.1-10.1.0.254 srcip=SubnetGrp_Name_A srcip=Subnet_Name_A To create a subnet list or subnet group, see Subnets.
Wildcard search	You can use wildcard searches for all field types. Examples: srcip=192.168.1.* policyid=1* user=*

Log View also supports the regex (regular expresion) syntax.

Filtering FortiClient log messages in FortiGate traffic logs

For FortiClient endpoints registered to FortiGate devices, you can filter log messages in FortiGate traffic log files that are triggered by FortiClient.

To Filter FortiClient log messages:

1. Go to Log View > FortiGate > Traffic.
2. In the Add Filter box, type fct_devid=*. A list of FortiGate traffic logs triggered by FortiClient is displayed.
3. In the message log list, select a FortiGate traffic log to view the details in the bottom pane.
4. Click the FortiClient tab, and double-click a FortiClient traffic log to see details.

   The FortiClient tab is available only when the FortiGate traffic logs reference FortiClient traffic logs.