Viewing message details

To view message details:

1. Double-click a message in the message list.

   The details pane is displayed to the right of the message list, with the fields categorized in tree view.

   

   You can display the log details pane below the message list by clicking the Bottom icon in the log details pane. When the log details pane is displayed below the message list, you can move it to the right of the log message list by clicking the Right icon. This is sometimes referred to as docking the pane to the bottom or right of the screen.

The log details pane provides shortcuts for adding or replacing filters and for showing or hiding a column. Right-click a log field to select an option.

If the log message contains UTM logs, you can click the UTM log icon in the log details pane to open the UTM log view window.

If the log message contains IPS signature information, you can click the IPS signature link under Attack Name to view the IPS Signature details in a dialog window.

To view FortiWEB packet logs:

1. Go to Log View > Logs > Fortinet Logs, and select the FortiWeb device type.
2. From the log type dropdown, select Attack log.
3. Double-click a message in the list to open the log details pane.
4. In the Data field, click the Device icon. The View Attack Content dialog displays a subset of FortiWEB's packet log (headers, arguments, and a truncated HTTP body). The maximum size of the packet log is 8 KB.

   

The Device icon is also available in the Data column. To display the column, click More Columns, and select Data from the dropdown.

To download an encrypted archive file in ZIP format:

You can set packet capture (PCAP) files to download from FortiAnalyzer encrypted and/or in ZIP format.

By default, PCAP files are downloaded in ZIP format. To adjust this setting, use the following command in the FortiAnalyzer CLI:

config system log pcap-file

set download-mode {plain | zip | zip-with-password}

end

You can download archive files from logs via the FortiAnalyzer GUI in the log detail panel. The below example demonstrates how to download a PCAP file that is encrypted in ZIP format.

1. In the FortiAnalyzer CLI, set the pcap-file download mode to zip-with-password:

   config system log pcap-file

   set download-mode zip-with-password

   end

2. In the FortiAnalyzer GUI, go to Log View and double-click a log containing an archive file.

3. In the Data section, click the download icon for the Archive field.

   The file is downloaded and the password displays in the FortiAnalyzer GUI. You can copy the password, as needed.

   To unlock the downloaded file, if appropriate, you must use the password.