debug flow filter

Use these commands to generate only packet flow debug logs that match your filter criteria, such as a specific destination IP address.

Before you will be able to see any debug logs, you must first enable debug log output using the command debug.

To use this command, your administrator account’s access control profile requires only r permission in any profile area. For details, see Permissions.

Syntax

To show the details of traffic flows (including HTTP, FTP, etc.), run the following commands. You can use client-ip, server-ip, and policy as the filter conditions (these filter conditions are in "AND" relation)..

diagnose debug enable

diagnose debug flow trace start

diagnose debug flow filter flow-detail debug flow filter

diagnose debug flow filter client-ip debug flow filter

diagnose debug flow filter server-ip debug flow filter

diagnose debug flow filter policy <policy_name>

diagnose debug flow trace stop

To show the details of the traffic flows passing through certain modules, run the following commands. You can use client-ip, server-ip, and policy as the filter conditions (these filter conditions are in "AND" relation).

diagnose debug enable

diagnose debug flow trace start

diagnose debug flow filter module-detail {x-forworded-for | ip-list | ip-reputation | quarant-ip | known-engine | geo-block | ...| url-rewriting} <verbosity-level_int>

diagnose debug flow filter client-ipdebug flow filter

diagnose debug flow filter server-ip debug flow filter

diagnose debug flow filter policy <policy_name>

diagnose debug flow trace stop

To show the details of the HTTP traffic flows, run the following commands. You can use client-ip, server-ip, and policy as the filter conditions (these filter conditions are in "AND" relation).

diagnose debug enable

diagnose debug flow trace start

diagnose debug flow filter http-detail debug flow filter

diagnose debug flow filter client-ip debug flow filter

diagnose debug flow filter server-ip debug flow filter

diagnose debug flow filter policy <policy_name>

diagnose debug flow trace stop

Variable	Description	Default
{x-forworded-for \| ip-list \| ip-reputation \| quarant-ip \| known-engine \| geo-block \| ...\| url-rewriting} <verbosity-level_int>	Select the name of module that needs to be traced (separated by space). Enter `diagnose debug flow filter module-detail ?` to display all the available module names if you don't know the exact name of the module.	No default.
<verbosity-level_int>	Specify the verbosity level to output to the CLI display after the command executes. The valid range is 0–7, where 0 disables debug logs and 7 generates the most verbose logging. If you omit the number, the CLI displays the current verbosity level. The default verbosity-level value for `flow-detail` is 1. For `http-detail` and `module-detail`, the default value is 0, which means "disabled".	0 or 1
<source_ipv4 \| source_ipv6>	Enter the source (`SRC`) IP address of connections. This will generate only packet flow debug log messages involving that source IP address. Note: This filter operates at the IP layer, not the HTTP layer. If a load balancer or other web proxy is deployed in front of FortiWeb, and therefore all connections for HTTP requests appear to originate from this IP address, configuring this filter will have no effect. Similarly, if multiple clients share an Internet connection via NAT or explicit web proxy, configuring this filter will only isolate connections that share this IP address. It will not be able to filter out a single client based on individual HTTP sessions from that IP.	No default.
<destination_ipv4 \| destination_ipv6>	Enter the destination (`DST`) IP address of the connection, either the: Virtual server on FortiWeb (if FortiWeb is operating in Reverse Proxy mode) Protected web server on the back end (all other operation modes) This will generate only packet flow debug log messages involving that server IP address.	No default.
<policy_name>	Enter the name of the server policy to filter out the connections that match the Network Configuration in the policy.	No default.