Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

log

Use the following commands to configure log settings.

log alert

Use this command to configure log based alert settings.

Syntax

config system log alert

set max-alert-count <integer>

end

Variable

Description

max-alert-count <integer>

Maximum number of alerts supported. Range: 100 to 1000

log ioc

Use this command to configure log based IoC (Indicators of Compromise) settings.

Syntax

config system log ioc

set notification {enable | disable}

set notification-throttle <integer>

set status

end

Variable

Description

notification {enable | disable}

Enable / disable IoC notification (default = enable).

notification-throttle <integer>

Set the minute value for throttling the rate of IoC notifications (1 - 10080, default = 1440).

status

Enable / disable the IoC feature (default = enable).

log mail-domain

Use this command to enable restrictions on email domains. By default, this option is disabled. The logs for different email domains are stored in the same ADOM.

When this option is enabled through the CLI, FortiAnalyzer identifies the email doamins from the logs. It creates a list of VDOMS in the device manager based on the email domains. The VDOMS are assigned to different ADOMS. When inserting a log to the database, FortiAnalyzer records the log to its corresponding ADOM based on the email domain information in the log. The VDOM field of the log is sent to the email domain name.

Syntax

config system log mail-domain

edit <id>

set domain <string>

set code <string>

set device <id>

end

Variable

Description

<id>

Identity of the FortiMail domain.

domain <string>

Domain name of the organization.

code <string>

URL of the organization.

device <id>

Device ID.

Example

conf system log mail-domain

edit 1

set domain company-name.

set code name.com

set device All_FortiMails

next

edit 2

set domain network-cnet

set code cnet.net

set device FE00000000000001

next

edit 3

set domain mail.myfortinet.com

set code myftntmail

set device FE00000000000002,FE00000000000003

next

end

log settings

Use this command to configure settings for logs.

Syntax

config system log settings

set dns-resolve-dstip {disable | enable}

set download-max-logs <integer>

set FAC-custom-field1 <string>

set FCH-custom-field1 <string>

set FCT-custom-field1 <string>

set FDD-custom-field1 <string>

set FGT-custom-field1 <string>

set FML-custom-field1 <string>

set FMG-custom-field1 <string>

set FWB-custom-field1 <string>

set FAZ-custom-field1 <string>

set FSA-custom-field1 <string>

set ha-auto-migrate {disable | enable}

set browse-max-logfiles <integer>

set import-max-logfiles <integer>

set log-file-archive-name {basic | extended}

set sync-search-timeout <integer>

config rolling-regular

set days {fri | mon| sat | sun | thu | tue | wed}

set del-files {disable | enable}

set directory <string>

set file-size <integer>

set gzip-format {disable | enable}

set hour <integer>

set ip <ipv4_address>

set ip2 <ipv4_address>

set ip3 <ipv4_address>

set log-format {csv | native | text}

set min <integer>

set password <passwd>

set password2 <passwd>

set password3 <passwd>

set server-type {ftp | scp | sftp}

set upload {disable | enable}

set upload-hour <integer>

set upload-mode {backup | mirror}

set upload-trigger {on-roll | on-schedule}

set username <string>

set username2 <string>

set username3 <string>

set when {daily | none | weekly}

end

end

Variable

Description

dns-resolve-stip {disable | enable}

Enable/Disable resolving destination IP by DNS. Default: enable.

download-max-logs <integer>

Maximum number of logs for each log download attempt.

FAC-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FCH-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FCT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FDD-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FGT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FML-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FMG-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FWB-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FAZ-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FSA-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

ha-auto-migrate {disable | enable}

Enabled/Disable automatically merging HA member's logs to HA cluster.

browse-max-logfiles <integer>

Maximum number of log files for each log browse attempt, per ADOM. Default: 10000.

import-max-logfiles <integer>

Maximum number of log files for each log import attempt. Default: 10000.

log-file-archive-name {basic | extended}

Log file name format for archiving.

  • basic: Basic format for log archive file name (default), for example:

    FGT20C0000000001.tlog.1417797247.log.

  • extended: Extended format for log archive file name, for example:

    FGT20C0000000001.2014-12-05-08:34:58.tlog.1417797247.log.

sync-search-timeout <integer>

The maximum number of seconds that a log search session can run in synchronous mode. Default: 60.

Variables forconfig rolling-regularsubcommand:

days {fri | mon| sat | sun | thu | tue | wed}

Log files rolling schedule (days of the week). When when is set to weekly, you can configure days, hour, and min values.

del-files {disable | enable}

Enable/disable log file deletion after uploading.

directory <string>

The upload server directory. Character limit: 127

file-size <integer>

Roll log files when they reach this size (MB). Range: 10 to 500 (MB). Default: 200 (MB)

gzip-format {disable | enable}

Enable/disable compression of uploaded log files.

hour <integer>

Log files rolling schedule (hour).

ip <ipv4_address>

ip2 <ipv4_address>

ip3 <ipv4_address>

Upload server IPv4 addresses. Configure up to three servers.

log-format {csv | native | text}

Format of uploaded log files. The following options are available: 

  • csv: CSV (comma-separated value) format.
  • native: Native format (text or compact).
  • text: Text format (convert if necessary).

min <integer>

Log files rolling schedule (minutes).

password <passwd>

password2 <passwd>

password3 <passwd>

Upload server login passwords. Character limit: 128

server-type {ftp | scp | sftp}

Upload server type. The following options are available: 

  • ftp: Upload via FTP server.
  • scp: Upload via SCP server.
  • sftp: Upload via SFTP server.

upload {disable | enable}

Enable/disable log file uploads.

upload-hour <integer>

Log files upload schedule (hour).

upload-mode {backup | mirror}

Configure upload mode with multiple servers. Servers are attempted and used one after the other upon failure to connect. The following options are available: 

  • backup: Servers are attempted and used one after the other upon failure to connect.
  • mirror: All configured servers are attempted and used.

upload-trigger {on-roll | on-schedule}

Event triggering log files upload: 

  • on-roll: Upload log files after they are rolled.
  • on-schedule: Upload log files daily.

username <string>

username2 <string>

username3 <string>

Upload server login usernames. Character limit: 35

when {daily | none | weekly}

Roll log files periodically. The following options are available: 

  • daily: Roll log files daily.
  • none: Do not roll log files periodically.
  • weekly: Roll log files on certain days of week.

log

Use the following commands to configure log settings.

log alert

Use this command to configure log based alert settings.

Syntax

config system log alert

set max-alert-count <integer>

end

Variable

Description

max-alert-count <integer>

Maximum number of alerts supported. Range: 100 to 1000

log ioc

Use this command to configure log based IoC (Indicators of Compromise) settings.

Syntax

config system log ioc

set notification {enable | disable}

set notification-throttle <integer>

set status

end

Variable

Description

notification {enable | disable}

Enable / disable IoC notification (default = enable).

notification-throttle <integer>

Set the minute value for throttling the rate of IoC notifications (1 - 10080, default = 1440).

status

Enable / disable the IoC feature (default = enable).

log mail-domain

Use this command to enable restrictions on email domains. By default, this option is disabled. The logs for different email domains are stored in the same ADOM.

When this option is enabled through the CLI, FortiAnalyzer identifies the email doamins from the logs. It creates a list of VDOMS in the device manager based on the email domains. The VDOMS are assigned to different ADOMS. When inserting a log to the database, FortiAnalyzer records the log to its corresponding ADOM based on the email domain information in the log. The VDOM field of the log is sent to the email domain name.

Syntax

config system log mail-domain

edit <id>

set domain <string>

set code <string>

set device <id>

end

Variable

Description

<id>

Identity of the FortiMail domain.

domain <string>

Domain name of the organization.

code <string>

URL of the organization.

device <id>

Device ID.

Example

conf system log mail-domain

edit 1

set domain company-name.

set code name.com

set device All_FortiMails

next

edit 2

set domain network-cnet

set code cnet.net

set device FE00000000000001

next

edit 3

set domain mail.myfortinet.com

set code myftntmail

set device FE00000000000002,FE00000000000003

next

end

log settings

Use this command to configure settings for logs.

Syntax

config system log settings

set dns-resolve-dstip {disable | enable}

set download-max-logs <integer>

set FAC-custom-field1 <string>

set FCH-custom-field1 <string>

set FCT-custom-field1 <string>

set FDD-custom-field1 <string>

set FGT-custom-field1 <string>

set FML-custom-field1 <string>

set FMG-custom-field1 <string>

set FWB-custom-field1 <string>

set FAZ-custom-field1 <string>

set FSA-custom-field1 <string>

set ha-auto-migrate {disable | enable}

set browse-max-logfiles <integer>

set import-max-logfiles <integer>

set log-file-archive-name {basic | extended}

set sync-search-timeout <integer>

config rolling-regular

set days {fri | mon| sat | sun | thu | tue | wed}

set del-files {disable | enable}

set directory <string>

set file-size <integer>

set gzip-format {disable | enable}

set hour <integer>

set ip <ipv4_address>

set ip2 <ipv4_address>

set ip3 <ipv4_address>

set log-format {csv | native | text}

set min <integer>

set password <passwd>

set password2 <passwd>

set password3 <passwd>

set server-type {ftp | scp | sftp}

set upload {disable | enable}

set upload-hour <integer>

set upload-mode {backup | mirror}

set upload-trigger {on-roll | on-schedule}

set username <string>

set username2 <string>

set username3 <string>

set when {daily | none | weekly}

end

end

Variable

Description

dns-resolve-stip {disable | enable}

Enable/Disable resolving destination IP by DNS. Default: enable.

download-max-logs <integer>

Maximum number of logs for each log download attempt.

FAC-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FCH-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FCT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FDD-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FGT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FML-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FMG-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FWB-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FAZ-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

FSA-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31.

ha-auto-migrate {disable | enable}

Enabled/Disable automatically merging HA member's logs to HA cluster.

browse-max-logfiles <integer>

Maximum number of log files for each log browse attempt, per ADOM. Default: 10000.

import-max-logfiles <integer>

Maximum number of log files for each log import attempt. Default: 10000.

log-file-archive-name {basic | extended}

Log file name format for archiving.

  • basic: Basic format for log archive file name (default), for example:

    FGT20C0000000001.tlog.1417797247.log.

  • extended: Extended format for log archive file name, for example:

    FGT20C0000000001.2014-12-05-08:34:58.tlog.1417797247.log.

sync-search-timeout <integer>

The maximum number of seconds that a log search session can run in synchronous mode. Default: 60.

Variables forconfig rolling-regularsubcommand:

days {fri | mon| sat | sun | thu | tue | wed}

Log files rolling schedule (days of the week). When when is set to weekly, you can configure days, hour, and min values.

del-files {disable | enable}

Enable/disable log file deletion after uploading.

directory <string>

The upload server directory. Character limit: 127

file-size <integer>

Roll log files when they reach this size (MB). Range: 10 to 500 (MB). Default: 200 (MB)

gzip-format {disable | enable}

Enable/disable compression of uploaded log files.

hour <integer>

Log files rolling schedule (hour).

ip <ipv4_address>

ip2 <ipv4_address>

ip3 <ipv4_address>

Upload server IPv4 addresses. Configure up to three servers.

log-format {csv | native | text}

Format of uploaded log files. The following options are available: 

  • csv: CSV (comma-separated value) format.
  • native: Native format (text or compact).
  • text: Text format (convert if necessary).

min <integer>

Log files rolling schedule (minutes).

password <passwd>

password2 <passwd>

password3 <passwd>

Upload server login passwords. Character limit: 128

server-type {ftp | scp | sftp}

Upload server type. The following options are available: 

  • ftp: Upload via FTP server.
  • scp: Upload via SCP server.
  • sftp: Upload via SFTP server.

upload {disable | enable}

Enable/disable log file uploads.

upload-hour <integer>

Log files upload schedule (hour).

upload-mode {backup | mirror}

Configure upload mode with multiple servers. Servers are attempted and used one after the other upon failure to connect. The following options are available: 

  • backup: Servers are attempted and used one after the other upon failure to connect.
  • mirror: All configured servers are attempted and used.

upload-trigger {on-roll | on-schedule}

Event triggering log files upload: 

  • on-roll: Upload log files after they are rolled.
  • on-schedule: Upload log files daily.

username <string>

username2 <string>

username3 <string>

Upload server login usernames. Character limit: 35

when {daily | none | weekly}

Roll log files periodically. The following options are available: 

  • daily: Roll log files daily.
  • none: Do not roll log files periodically.
  • weekly: Roll log files on certain days of week.