Traffic logs

The forward traffic log includes log messages for traffic that passes through the FortiProxy device. It includes both traffic and security log messages so that messages about security events can be viewed alongside messages about the traffic at the time of the event.

See also Logging client IP for forward traffic and HTTP transaction.

HTTP transaction-related traffic log.

To allow HTTP transaction log to appear here, make sure the Log HTTP Transaction option is not disabled when you Create or edit a policy.

See also Logging client IP for forward traffic and HTTP transaction.

Correlation log of forward traffic log(s) and HTTP transaction log(s) that have a common session ID.

The sniffer log records all traffic that passes through a particular interface that has been configured to act as a One-Armed Sniffer, so it can be examined separately from the rest of the traffic logs.

System Event logs

General system events.

Events relating to layer-3 routing.

Events relating to VPN.

Events relating to users.

Events relating to HA

Events relating to Security Rating.

Events relating to WAN optimization and cache.

Events relating to Fabric connectors.

Events relating to CIFS.

The REST API events log subtype logs POST, PUT, DELETE, and GET REST API requests. They can be enabled or disabled in the CLI:

config log setting
    set rest-api-set {enable | disable}
    set rest-api-get {enable | disable}
end

Security Event logs

The antivirus log records when, during the antivirus scanning process, the FortiProxy unit finds a match within the antivirus profile, which includes the presence of a virus or grayware signature.

The web filter log records HTTP log rating errors, including web content blocking actions that the FortiProxy device performs. It also includes how long it takes to scan the HTTP request, the client request host header, the client request host inside of the request line, and the server response code.

Records detected and blocked malicious SSL connections.

The DNS query log messages include details of each DNS query and response. DNS log messages are recorded for all DNS traffic though the FortiProxy unit and originated by the FortiProxy unit.

The detailed DNS log can be used for low-impact security investigation. Most network activity involves DNS activity of some kinds. Analyzing the DNS log can provide a lot of details about the activity on your network without using resource-intensive techniques.

Records file filter events.

The data loss prevention (DLP) log provides valuable information about the sensitive data trying to get through to your network as well as any unwanted data trying to get into your network.

The DLP log can record the following traffic types:

• email (SMTP, POP3, or IMAP; if SSL content, SMTPS, POP3S, and IMAPS)

• HTTP

• HTTPS

• FTP

• NNTP

• IM

The Application Control log provides detailed information about the traffic that internet applications such as Skype are generating. The Application Control feature controls the flow of traffic from a specific application, and the FortiProxy unit examines this traffic for signatures that the application generates.

The log messages that are recorded provide information such as the type of application being used (such as P2P software), and what type of action the FortiProxy unit took. These log messages can also help you to determine the top ten applications that are being used on your network. This feature is called Application Control monitoring and you can view the information from a widget on the Executive Summary page.

The Application Control list that is used must have logging enabled within the list, as well as logging enabled within each application entry. Each application entry can also have packet logging enabled. Packet logging for Application Control records the packet when an application type is identified, similar to IPS packet logging.

Logging of Application Control activity can only be recorded when an Application Control list is applied to a firewall policy, regardless of whether or not logging is enabled within the Application Control list.

The Intrusion Prevention log, also referred to as the attack log, records attacks that occurred against your network. Attack logs contain detailed information about whether the FortiProxy unit protected the network using anomaly-based defense settings or signature-based defense settings, as well as what the attack was.

The Intrusion Prevention or attack log file is especially useful because the log messages that are recorded contain a link to the FortiGuard Center, where you can find more information about the attack. This is similar to antivirus logs, where a link to the FortiGuard Center is provided as well that informs you of the virus that was detected by the FortiProxy unit.

An Intrusion Prevention sensor with log settings enabled must be applied to a firewall policy so that the FortiProxy unit can record the activity.