Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiAuthenticator 6.4.10 Administration Guide
    6.4.10
    6.6.2
    6.6.1
    6.6.0
    6.5.5
    6.5.4
    6.5.3
    6.5.2
    6.5.1
    6.5.0
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.2
    6.2.1
    6.2.0
    6.1.3
    6.1.2
    6.1.1
    6.1.0
    6.0.8
    6.0.7
    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0
    5.5.0
    5.4.0
    5.3.0
    5.2.0
    5.1.0
    5.0.0
    4.3.0
    4.2.1
    4.2.0

    Log access

    Log access

    To view the log events table, go to Logging > Log Access > Logs.

    The following options and information are available:

    Refresh

    Refresh the log list.

    Simplified/ Full View

    Simplified or full log view.

    Downloads

    Using Raw Log from the dropdown, export the FortiAuthenticator log to your computer as a text file named fac.log.

    You can also download a full debug report for one of the following from the dropdown:

    • Summary
    • Authentication
    • Database
    • GUI
    • LDAP Sync
    • Accounting
    • Authorization
    • SSO
    • System
    • Push Authentication
    • REST API

    Search by substring (e.g. username)

    Enter a search term in the search field to search the log message list.

    The search string must appear in the Message portion of the log entry to result in a match. To prevent each term in a phrase from matching separately, multiple keywords must be in quotes and be an exact match.

    After the search is complete the number of positive matches is displayed next to the Search button, with the total number of log entries in brackets following. Select the total number of log entries to return to the full list. Subsequent searches will search all the log entries, and not just the previous search’s results.

    Use the search bar to retrieve log records containing the specified substring (case-insensitive) in one of the following columns:

    • Short Message

    • Category

    • Sub Category

    • Log Type ID

    • User

    • Source IP

    Time period

    Select the clock icon and filter the log events table by selecting from the following available time periods:

    • Last hour

    • Last 8 hours

    • Last 24 hours

    • Last 7 days

    • Last month

    • Last 3 months

    • Last year

    • All

    Reset table column widths

    Select the reset icon to reset the table column widths to default.

    ID

    The log message’s ID.

    Timestamp

    The time the message was received.

    Short Message

    The log message itself, sometimes slightly shortened.

    Level

    The log severity level:

    • Emergency: The system has become unstable.
    • Alert: Immediate action is required.
    • Critical: Functionality is affected.
    • Error: An erroneous condition exists, and functionality is probably affected.
    • Warning: Functionality could be affected.
    • Notification: Information about normal events.
    • Information: General information about system operations.
    • Debug: Detailed information useful for debugging purposes.

    Category

    The log category, which is always Event. See Log access.

    Sub Category

    The log subcategory. See Log access.

    Log Type ID

    The log type ID.

    Action

    The action which created the log message, if applicable.

    Status

    The status of the action that created the log message, if applicable.

    User

    The user to whom the log message pertains.

    Source IP

    The source IP address of the relevant device if an authentication action fails.
    To view log details:

    From the log list, select the log whose details you need to view by clicking anywhere within the log’s row. The Log Details pane will open on the right side of the window.

    After viewing the log details, select the close icon in the top right corner of the pane to close the details pane.

    Sort the log messages

    The log message table can be sorted by any column. To sort the log entries by a particular column, select the title for that column. The log entries will now be displayed based on data in that column in ascending order. Select the column heading again to sort the entries in descending order. Ascending or descending is displayed with an arrow next to the column title, an up arrow for ascending and down arrow for descending.

    Previous
    Next

    Log access

    Log access

    To view the log events table, go to Logging > Log Access > Logs.

    The following options and information are available:

    Refresh

    Refresh the log list.

    Simplified/ Full View

    Simplified or full log view.

    Downloads

    Using Raw Log from the dropdown, export the FortiAuthenticator log to your computer as a text file named fac.log.

    You can also download a full debug report for one of the following from the dropdown:

    • Summary
    • Authentication
    • Database
    • GUI
    • LDAP Sync
    • Accounting
    • Authorization
    • SSO
    • System
    • Push Authentication
    • REST API

    Search by substring (e.g. username)

    Enter a search term in the search field to search the log message list.

    The search string must appear in the Message portion of the log entry to result in a match. To prevent each term in a phrase from matching separately, multiple keywords must be in quotes and be an exact match.

    After the search is complete the number of positive matches is displayed next to the Search button, with the total number of log entries in brackets following. Select the total number of log entries to return to the full list. Subsequent searches will search all the log entries, and not just the previous search’s results.

    Use the search bar to retrieve log records containing the specified substring (case-insensitive) in one of the following columns:

    • Short Message

    • Category

    • Sub Category

    • Log Type ID

    • User

    • Source IP

    Time period

    Select the clock icon and filter the log events table by selecting from the following available time periods:

    • Last hour

    • Last 8 hours

    • Last 24 hours

    • Last 7 days

    • Last month

    • Last 3 months

    • Last year

    • All

    Reset table column widths

    Select the reset icon to reset the table column widths to default.

    ID

    The log message’s ID.

    Timestamp

    The time the message was received.

    Short Message

    The log message itself, sometimes slightly shortened.

    Level

    The log severity level:

    • Emergency: The system has become unstable.
    • Alert: Immediate action is required.
    • Critical: Functionality is affected.
    • Error: An erroneous condition exists, and functionality is probably affected.
    • Warning: Functionality could be affected.
    • Notification: Information about normal events.
    • Information: General information about system operations.
    • Debug: Detailed information useful for debugging purposes.

    Category

    The log category, which is always Event. See Log access.

    Sub Category

    The log subcategory. See Log access.

    Log Type ID

    The log type ID.

    Action

    The action which created the log message, if applicable.

    Status

    The status of the action that created the log message, if applicable.

    User

    The user to whom the log message pertains.

    Source IP

    The source IP address of the relevant device if an authentication action fails.
    To view log details:

    From the log list, select the log whose details you need to view by clicking anywhere within the log’s row. The Log Details pane will open on the right side of the window.

    After viewing the log details, select the close icon in the top right corner of the pane to close the details pane.

    Sort the log messages

    The log message table can be sorted by any column. To sort the log entries by a particular column, select the title for that column. The log entries will now be displayed based on data in that column in ascending order. Select the column heading again to sort the entries in descending order. Ascending or descending is displayed with an arrow next to the column title, an up arrow for ascending and down arrow for descending.

    Previous
    Next