log
Use the following commands to configure log settings.
log alert
Use this command to configure log based alert settings.
Syntax
config system log alert
set max-alert-count <integer>
end
Variable |
Description |
---|---|
max-alert-count <integer> |
Maximum number of alerts supported. Range: 100 to 1000 |
log ioc
Use this command to configure log based IoC (Indicators of Compromise) settings.
Syntax
config system log ioc
set notification {enable | disable}
set notification-throttle <integer>
set status
end
Variable |
Description |
---|---|
notification {enable | disable} |
Enable / disable IoC notification (default = enable). |
notification-throttle <integer> |
Set the minute value for throttling the rate of IoC notifications (1 - 10080, default = 1440). |
status |
Enable / disable the IoC feature (default = enable). |
log mail-domain
Use this command to enable restrictions on email domains. By default, this option is disabled. The logs for different email domains are stored in the same ADOM.
When this option is enabled through the CLI, FortiAnalyzer identifies the email doamins from the logs. It creates a list of VDOMS in the device manager based on the email domains. The VDOMS are assigned to different ADOMS. When inserting a log to the database, FortiAnalyzer records the log to its corresponding ADOM based on the email domain information in the log. The VDOM field of the log is sent to the email domain name.
Syntax
config system log mail-domain
edit <id>
set domain <string>
set code <string>
set device <id>
end
Variable |
Description |
---|---|
<id> |
Identity of the FortiMail domain. |
domain <string> |
Domain name of the organization. |
code <string> |
URL of the organization. |
device <id> |
Device ID. |
Example
conf system log mail-domain
edit 1
set domain company-name.
set code name.com
set device All_FortiMails
next
edit 2
set domain network-cnet
set code cnet.net
set device FE00000000000001
next
edit 3
set domain mail.myfortinet.com
set code myftntmail
set device FE00000000000002,FE00000000000003
next
end
log settings
Use this command to configure settings for logs.
Syntax
config system log settings
set dns-resolve-dstip {disable | enable}
set download-max-logs <integer>
set FAC-custom-field1 <string>
set FCH-custom-field1 <string>
set FCT-custom-field1 <string>
set FDD-custom-field1 <string>
set FGT-custom-field1 <string>
set FML-custom-field1 <string>
set FMG-custom-field1 <string>
set FWB-custom-field1 <string>
set FAZ-custom-field1 <string>
set FSA-custom-field1 <string>
set ha-auto-migrate {disable | enable}
set browse-max-logfiles <integer>
set import-max-logfiles <integer>
set log-file-archive-name {basic | extended}
set sync-search-timeout <integer>
config rolling-regular
set days {fri | mon| sat | sun | thu | tue | wed}
set del-files {disable | enable}
set directory <string>
set file-size <integer>
set gzip-format {disable | enable}
set hour <integer>
set ip <ipv4_address>
set ip2 <ipv4_address>
set ip3 <ipv4_address>
set log-format {csv | native | text}
set min <integer>
set password2 <passwd>
set password3 <passwd>
set server-type {ftp | scp | sftp}
set upload {disable | enable}
set upload-hour <integer>
set upload-mode {backup | mirror}
set upload-trigger {on-roll | on-schedule}
set username <string>
set username2 <string>
set username3 <string>
set when {daily | none | weekly}
end
end
Variable |
Description |
---|---|
dns-resolve-stip {disable | enable} |
Enable/Disable resolving destination IP by DNS. Default: enable. |
download-max-logs <integer> |
|
FAC-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FCH-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FCT-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FDD-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FGT-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FML-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FMG-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FWB-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FAZ-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
FSA-custom-field1 <string> |
Enter a name of the custom log field to index. Character limit: 31. |
ha-auto-migrate {disable | enable} |
Enabled/Disable automatically merging HA member's logs to HA cluster. |
browse-max-logfiles <integer> |
Maximum number of log files for each log browse attempt, per ADOM. Default: 10000. |
import-max-logfiles <integer> |
Maximum number of log files for each log import attempt. Default: 10000. |
log-file-archive-name {basic | extended} |
Log file name format for archiving.
|
sync-search-timeout <integer> |
The maximum number of seconds that a log search session can run in synchronous mode. Default: 60. |
Variables for |
|
days {fri | mon| sat | sun | thu | tue | wed} |
Log files rolling schedule (days of the week). When |
del-files {disable | enable} |
Enable/disable log file deletion after uploading. |
directory <string> |
The upload server directory. Character limit: 127 |
file-size <integer> |
Roll log files when they reach this size (MB). Range: 10 to 500 (MB). Default: 200 (MB) |
gzip-format {disable | enable} |
Enable/disable compression of uploaded log files. |
hour <integer> |
Log files rolling schedule (hour). |
ip <ipv4_address> ip2 <ipv4_address> ip3 <ipv4_address> |
Upload server IPv4 addresses. Configure up to three servers. |
log-format {csv | native | text} |
Format of uploaded log files. The following options are available:
|
min <integer> |
Log files rolling schedule (minutes). |
password <passwd> password2 <passwd> password3 <passwd> |
Upload server login passwords. Character limit: 128 |
server-type {ftp | scp | sftp} |
Upload server type. The following options are available:
|
upload {disable | enable} |
Enable/disable log file uploads. |
upload-hour <integer> |
Log files upload schedule (hour). |
upload-mode {backup | mirror} |
Configure upload mode with multiple servers. Servers are attempted and used one after the other upon failure to connect. The following options are available:
|
upload-trigger {on-roll | on-schedule} |
Event triggering log files upload:
|
username <string> username2 <string> username3 <string> |
Upload server login usernames. Character limit: 35 |
when {daily | none | weekly} |
Roll log files periodically. The following options are available:
|