log traffic-log

Use this command to have the FortiWeb appliance record traffic log messages on its local disk. This command also lets you save packet payloads with the traffic logs.

You must enable disk log storage and select log severity levels using log disk before any traffic logs are stored on disk.

Packet payloads supplement the log message by providing the actual data associated with the traffic log, which may help you to analyze traffic patterns.

You can view packet payloads in the Packet Log column when viewing a traffic logs using the web UI. For details, see the FortiWeb Administration Guide:

http://docs.fortinet.com/fortiweb/admin-guides

To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For details, see Permissions.

Syntax

config log traffic-log

set packet-log {enable | disable}

set status {enable | disable}

set low-priority {enable | disable}

end

Variable	Description	Default
status {enable | disable}	Enable to record traffic log messages if disk log storage is enabled, and the logs meet or exceed the severity levels selected using log disk.	disable
packet-log {enable | disable}	Enable to keep packet payloads stored with their associated traffic log message. For details about obscuring sensitive information in packet payloads, see log sensitive.	disable
message-event {enable | disable}		disable
low-priority {enable | disable}	Enable to set the attack log with a higher priority than the traffic log. This way, if the logd queue is more than 80% full, FortiWeb will stop generating traffic logs to prioritize the processing of attack logs until the logd queue drops below 80%. The following event log will be displayed to notify you of the logd status change: When the logd queue exceeds 80% and FortiWeb stops generating traffic logs, you will see the following event log: Log ID=11000516, Log Level=Debug, MSG=Alog to server queue will be full, pause tlog for a while, Action=pause When the server queue drops below 80% and FortiWeb resumes generating traffic logs, you will see the following event log: Log ID=11000514, Log Level=Debug, MSG=Alog to server queue is ok, resume tlog for a while, Action=resume	disable

Example

This example enables disk log storage, sets information as the minimum severity level that a log message must achieve for storage, enables recording of traffic logs and retention of all packet payloads along with the traffic logs.

config log disk

set status enable

set severity information

end

config log traffic-log

set status enable

set packet-log enable

end

Related topics

• log attack-log
• log event-log
• log disk
• log sensitive
• log