"<report_name>"

Enter the name of a new or existing report profile. The maximum length is 63 characters.

The profile name will be included in the report header.

To display the list of existing report names, enter:

edit ?

custom_company "<org_str>"

Enter the name of your department, company, or other organization, if any, that you want to include in the report summary. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 191 characters.

For details about enabling the summary, see scope_include_summary {yes | no}.

custom_footer_options {custom | report-title}

Select either:

• report-title—Use "<report_name>" as the footer text.
• custom—Provide different footer text.

custom_footer "<footer_str>"

Enter the text, if any, that you want to include at the bottom of each report page. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 127 characters.

This setting is available only if custom_footer_options {custom | report-title} is custom.

custom_header "<header_str>"

custom_header_logo "<filename_hex_str>"

custom_title_logo "<filename_hex_str>"

email_attachment_compress {enable | disable}

Enable to enclose the generated report formats in a compressed archive attached to the email.

This field is required if you have enabled email output by enabling one or more of the file formats for email output in output_email {html mht pdf rtf txt}.

email_attachment_name "<filename_str>"

Enter the file name that will be used for the reports attached to the email. The maximum length is 63 characters.

This field is required if you have enabled email output by enabling one or more of the file formats for email output in output_email {html mht pdf rtf txt}.

email_body "<message_str>"

Enter the message body of the email. The maximum length is 383 characters.

This field is required if you have enabled email output by enabling one or more of the file formats for email output in output_email {html mht pdf rtf txt}.

email_subject "<subject_str>"

Enter the subject line of the email. The maximum length is 191 characters.

This field is required if you have enabled email output by enabling one or more of the file formats for email output in output_email {html mht pdf rtf txt}.

filter_string "<log-filter_str>"

Enter a log message filter string that includes or excludes log messages based upon matching log field values. The maximum length is 1,023 characters.

For example syntax, see Example.

include_nodata {yes | no}

on_demand {enable | disable}

Enable to run the report one time only. After the FortiWeb appliance completes the report, it removes the report profile from its hard disk.

Enter disable to schedule a time to run the report, and to keep the report profile for subsequent use.

output_email {html mht pdf rtf txt}

output_email_policy "<policy_name>"

If you set a value for output_email, enter the name of the email policy that contains settings for sending the report by email. The maximum length is 63 characters.

For details about email policies, see log email-policy.

output_file {html mht pdf rtf txt}

output_ftp {html pdf rtf txt mht}

output_ftp_policy "<ftp-policy_name>"

period_end "<time_str>" "<date_str>"

Enter the time and date that define the end of the span of time whose log messages you want to use when generating the report.

The time format is hh:mm and the date format is yyyy/mm/dd, where:

• hh is the hour according to a 24-hour clock
• mm is the minute
• yyyy is the year
• mm is the month
• dd is the day

This setting appears only when you select a period_type {last-14-days | last-2-weeks | last-30-days | last-7-days | lastmonth | last-n-days | last-n-hours | last-n-weeks | last-quarter | last-week | other | this-month | this-quarter | this-week | thiyear | today | yesterday} of other.

period_last_n <n_int>

Enter the number that defines n if the period_type {last-14-days | last-2-weeks | last-30-days | last-7-days | lastmonth | last-n-days | last-n-hours | last-n-weeks | last-quarter | last-week | other | this-month | this-quarter | this-week | thiyear | today | yesterday} contains that variable. The valid range is from 1 to 2,147,483,647.

This setting appears only when you select a period_type of last-n-days, last-n-hours, or last-n-weeks.

period_start "<time_str>" "<date_str>"

Enter the time and date that defines the beginning of the span of time whose log messages you want to use when generating the report.

The time format is hh:mm and the date format is yyyy/mm/dd, where:

• hh is the hour according to a 24-hour clock
• mm is the minute
• yyyy is the year
• mm is the month
• dd is the day

This setting appears only when you select a period_type {last-14-days | last-2-weeks | last-30-days | last-7-days | lastmonth | last-n-days | last-n-hours | last-n-weeks | last-quarter | last-week | other | this-month | this-quarter | this-week | thiyear | today | yesterday} of other.

period_type {last-14-days | last-2-weeks | last-30-days | last-7-days | lastmonth | last-n-days | last-n-hours | last-n-weeks | last-quarter | last-week | other | this-month | this-quarter | this-week | thiyear | today | yesterday}

Select the span of time whose log messages you want to use when generating the report.

If you select last-n-days, last-n-hours, or last-nweeks, you must also define n by entering period_last_n <n_int>.

If you select other, you must also define the start and end of the report’s time range by entering period_start "<time_str>" "<date_str>" and period_end "<time_str>" "<date_str>".

The span of time will be included in the summary, if enabled. For information on enabling the summary, see scope_include_summary {yes | no}.

report_desc "<comment_str>"

Enter a description of the report, if any, that you want to include in the report summary. If the text is more than one word or contains special characters, surround it with double quotes ( " ). The maximum length is 63 characters.

For information on enabling the summary, see scope_include_summary {yes | no}.

report_title "<title_str>"

Enter a title, if any, that you want to include in the report summary. If the text is more than one word or contains special characters, enclose it in double quotes ( " ). The maximum length is 127 characters.

For information on enabling the summary, see scope_include_summary {yes | no}.

report_attack_activity {attacks-type attacks-url attacks-date-type attacks-month-type attacks-day-type attacks-hour-type attacks-type-dev attacks-dst-type attacks-dst-ip attacks-type-ip attacks-method-type attacks-cat attacks-policy attacks-day attacks-ts attacks-td attacks-proto attacks-date-severity attacks-month-severity attacks-day-severity attacks-hour-severity attacks-sessionid attacks-srccountry attacks-signature-id attacks-type-signature-id attacks-fortisandbox attacks-httphost attacks-username attacks-httprefer attacks-httpversion threat-weight-client-device attacks-client-device cat-client-device attack-summary attack-details}

Enter zero or more options to indicate which charts based upon attack logs to include in the report.

For example, to include “Attacks By Policy,” enter a list of charts that includes attacks-policy. To include “Top Attacked HTTP Methods by Type,” enter a list of charts that includes attacks-method-type.

report_event_activity {ev-all ev-all-cat ev-all-type ev-crit-hour ev-crit-day ev-warn-hour ev-warn-day ev-info-hour ev-info-day ev-emer-hour ev-emer-day ev-aler-hour ev-aler-day ev-err-hour ev-err-day ev-noti-hour ev-noti-day ev-hour ev-hour-cat ev-day ev-day-cat ev-stat ev-day-login ev-week-login ev-user-logint}

Enter zero or more options to indicate which charts based upon event logs to include in the report.

For example, to include “Top Event Categories by Status”, enter a list of charts that includes ev-stat.

report_traffic_activity {net-pol net-srv net-src net-dst net-src-dst net-dst-src net-date-dst net-hour-dst net-day-dst net-month-dst net-date-src net-hour-src net-day-src net-month-src net-srccountry net-httphost net-username net-httprefer net-httpversion net-client-device}

Enter zero or more options to indicate which charts based upon traffic logs to include in the report.

For example, to include “Top Sources By Day of Week”, enter a list of charts that includes net-day-src.

report_pci_activity {pci-attacks-date-type pci-attacks-month-type pci-attacks-day-type pci-attacks-hour-type}

schedule_type {daily | dates | days | none}

Select when the FortiWeb appliance will automatically run the report. If you reboot the FortiWeb appliance while the report is being generated, report generation resumes after the boot process is complete.

If schedule_type is daily, dates or days, specify the schedule_time, schedule_days, or schedule_dates when the report will be generated.

If schedule_type is none, the report will be generated only when you manually initiate it.

schedule_days {sun | mon | tue | wed | thu | fri | sat}

schedule_dates "<dates_str>"

schedule_time "<time_str>"

If schedule_type {daily | dates | days | none} is not none, select the time of day when the report should be run.

The time format is hh:mm, where:

• hh is the hour according to a 24-hour clock
• mm is the minute

scope_include_summary {yes | no}

Enter yes to include a summary section at the beginning of the report. The summary includes:

• "<report_name>"
• custom_company "<org_str>"
• report_desc "<comment_str>"
• the date and time when the report was generated using this profile
• the span of time whose log messages were used to generate the report, according to period_type {last-14-days | last-2-weeks | last-30-days | last-7-days | lastmonth | last-n-days | last-n-hours | last-n-weeks | last-quarter | last-week | other | this-month | this-quarter | this-week | thiyear | today | yesterday}

scope_include_table_of_content {yes | no}

scope_top1 <topX_int>

Enter x number of items (up to 30) to include in the first cross-section of ranked reports.

For some report types, you can set the top ranked items for the report. These reports have “Top” in their name, and will always show only the top x entries. Reports that do not include “Top” in their name show all information. Changing the values for top field will not affect these reports.