Fortinet black logo

CLI Reference

log setting local

log setting local

Use this command to configure log message storage on the local hard disk.

Syntax

config log setting local

set antispam-log-status {enable | disable}

set antivirus-log-status {enable | disable}

set disk-full {overwrite | nolog}

set encryption-log-status {enable | disable}

set event-log-category [{imap pop3 smtp webmail}]

set event-log-status {enable | disable}

set history-log-status {enable | disable}

set imap-mail-log-event delete

set loglevel {alert | critical | debug | emergency | error | information | notification | warning}

set pop3-mail-log-event delete

set retention-period <days_int>

set rotation-hour <hour_int>

set rotation-period <days_int>

set rotation-size <file-size_int>

set status {enable | disable}

set syseventlog-category [{admin configuration configuration-user dns ha system update}]

set system-event-log-status

end

Variable

Description

Default

antispam-log-status {enable | disable}

Enable to log all antispam events.

enable

antivirus-log-status {enable | disable}

Enable to log all antivirus events.

enable

disk-full {overwrite | nolog}

Enter the action the FortiMail unit will perform when the local disk is full and a new log message is caused:

  • overwrite: Delete the oldest log file in order to free disk space, and store the new log message.

  • nolog: Discard the new log message.

overwrite

encryption-log-status {enable | disable}

Enable to log all IBE events.

enable

event-log-category [{imap pop3 smtp webmail}]

Type all of the mail log types and subtypes that you want to record to this storage location. Separate each type with a space.

  • imap: Log all IMAP events.
  • pop3: Log all POP3 events.
  • smtp: Log all SMTP relay or proxy events.
  • webmail: Log all FortiMail webmail events.

webmail smtp

event-log-status {enable | disable}

Enable or disable event logging to the local hard disk.

enable

history-log-status {enable | disable}

Enable to log both successful and unsuccessful attempts by the built-in MTA or proxies to deliver email.

enable

imap-mail-log-event delete

Enable logging of delete action on email from IMAP mail client.

To disable this option, enter the following command:

unset imap-mail-log-event clear

delete

loglevel {alert | critical | debug | emergency | error | information | notification | warning}

Type one of the following severity levels:

  • emergency
  • alert
  • critical
  • error
  • warning
  • notification
  • information
  • debug

This log destination will receive log messages greater than or equal to this severity level. For details, see the FortiMail Administration Guide.

information

pop3-mail-log-event delete

Enable logging of delete action on email from POP3 mail client.

To disable this option, enter the following command:

unset pop3-mail-log-event clear

delete

retention-period <days_int>

Specify how long to keep the logs. Valid range is from 1 to 1461 days. Default value is 0, which means no limit.

0

rotation-hour <hour_int>

Enter the hour of the day when the rotation should start.

0

rotation-period <days_int>

Enter the maximum age of the current log file in days.

When the log file reaches either the maximum size or age, the log file is rolled (that is, the current log file is saved to a file with a new name, and a new log file is started).

10

rotation-size <file-size_int>

Enter the maximum size of the current log file in megabytes (MB). TValid range is from 1 to 500.

When the log file reaches either the maximum size or age, the log file is rolled (that is, the current log file is saved to a file with a new name, and a new log file is started).

100

status {enable | disable}

Enable to send log types which are enabled to the local hard disk.

enable

syseventlog-category [{admin configuration configuration-user dns ha system update}]

Type all of the system event log types and subtypes that you want to record to this storage location. Separate each type with a space.

  • admin: Administrative events such as logins, viewing log messages, and resetting the configuration.
  • configuration: Configuration changes by an administrator, such as policies, profiles, and domains.
  • configuration-user: Configuration changes by a quarantine or webmail user, such as personal safe/block lists.
  • dns: DNS queries.
  • ha: High availability (HA) activity.
  • system: System events, such as rebooting the FortiMail unit or IP address configuration via DHCP.

    Note: This category does not include events from mail daemons, which are configured in event-log-category [{imap pop3 smtp webmail}].

  • update: Both successful and unsuccessful attempts to download firmware and FortiGuard updates.

admin configuration configuration-user dns ha system update

system-event-log-status

Enable to log system events.

enable

Related topics

log setting remote

log alertemail recipient

log alertemail setting

log setting local

Use this command to configure log message storage on the local hard disk.

Syntax

config log setting local

set antispam-log-status {enable | disable}

set antivirus-log-status {enable | disable}

set disk-full {overwrite | nolog}

set encryption-log-status {enable | disable}

set event-log-category [{imap pop3 smtp webmail}]

set event-log-status {enable | disable}

set history-log-status {enable | disable}

set imap-mail-log-event delete

set loglevel {alert | critical | debug | emergency | error | information | notification | warning}

set pop3-mail-log-event delete

set retention-period <days_int>

set rotation-hour <hour_int>

set rotation-period <days_int>

set rotation-size <file-size_int>

set status {enable | disable}

set syseventlog-category [{admin configuration configuration-user dns ha system update}]

set system-event-log-status

end

Variable

Description

Default

antispam-log-status {enable | disable}

Enable to log all antispam events.

enable

antivirus-log-status {enable | disable}

Enable to log all antivirus events.

enable

disk-full {overwrite | nolog}

Enter the action the FortiMail unit will perform when the local disk is full and a new log message is caused:

  • overwrite: Delete the oldest log file in order to free disk space, and store the new log message.

  • nolog: Discard the new log message.

overwrite

encryption-log-status {enable | disable}

Enable to log all IBE events.

enable

event-log-category [{imap pop3 smtp webmail}]

Type all of the mail log types and subtypes that you want to record to this storage location. Separate each type with a space.

  • imap: Log all IMAP events.
  • pop3: Log all POP3 events.
  • smtp: Log all SMTP relay or proxy events.
  • webmail: Log all FortiMail webmail events.

webmail smtp

event-log-status {enable | disable}

Enable or disable event logging to the local hard disk.

enable

history-log-status {enable | disable}

Enable to log both successful and unsuccessful attempts by the built-in MTA or proxies to deliver email.

enable

imap-mail-log-event delete

Enable logging of delete action on email from IMAP mail client.

To disable this option, enter the following command:

unset imap-mail-log-event clear

delete

loglevel {alert | critical | debug | emergency | error | information | notification | warning}

Type one of the following severity levels:

  • emergency
  • alert
  • critical
  • error
  • warning
  • notification
  • information
  • debug

This log destination will receive log messages greater than or equal to this severity level. For details, see the FortiMail Administration Guide.

information

pop3-mail-log-event delete

Enable logging of delete action on email from POP3 mail client.

To disable this option, enter the following command:

unset pop3-mail-log-event clear

delete

retention-period <days_int>

Specify how long to keep the logs. Valid range is from 1 to 1461 days. Default value is 0, which means no limit.

0

rotation-hour <hour_int>

Enter the hour of the day when the rotation should start.

0

rotation-period <days_int>

Enter the maximum age of the current log file in days.

When the log file reaches either the maximum size or age, the log file is rolled (that is, the current log file is saved to a file with a new name, and a new log file is started).

10

rotation-size <file-size_int>

Enter the maximum size of the current log file in megabytes (MB). TValid range is from 1 to 500.

When the log file reaches either the maximum size or age, the log file is rolled (that is, the current log file is saved to a file with a new name, and a new log file is started).

100

status {enable | disable}

Enable to send log types which are enabled to the local hard disk.

enable

syseventlog-category [{admin configuration configuration-user dns ha system update}]

Type all of the system event log types and subtypes that you want to record to this storage location. Separate each type with a space.

  • admin: Administrative events such as logins, viewing log messages, and resetting the configuration.
  • configuration: Configuration changes by an administrator, such as policies, profiles, and domains.
  • configuration-user: Configuration changes by a quarantine or webmail user, such as personal safe/block lists.
  • dns: DNS queries.
  • ha: High availability (HA) activity.
  • system: System events, such as rebooting the FortiMail unit or IP address configuration via DHCP.

    Note: This category does not include events from mail daemons, which are configured in event-log-category [{imap pop3 smtp webmail}].

  • update: Both successful and unsuccessful attempts to download firmware and FortiGuard updates.

admin configuration configuration-user dns ha system update

system-event-log-status

Enable to log system events.

enable

Related topics

log setting remote

log alertemail recipient

log alertemail setting