FortiGate / FortiOS

FortiManager

FortiAnalyzer

Log Reference

Introduction
- Document scope & organization
Schema
- Device ID
- Log part
- Event time
- Timezone
- Log ID
- Type
- Subtype
- Severity/priority
- User
- UI
- Module
- Submodule
- Action
- Status
- Reason
- Virus ID
- Virus name
- Signature ID
- Score
- Checksum
- Web filtering category ID
- URL
- Session ID
- Client name
- Client IP address
- Client country code/location
- Destination IP address
- Endpoint
- From (envelope)
- From (header)
- To (envelope)
- Original recipient
- Policy ID
- Domain
- Mailer
- Resolved
- Source type
- Direction
- Virus
- Disposition
- Classifier
- Attachment type
- Message length
- Subject
- Message ID
- Received time
- Notification of delay
- Scan time
- Transfer time
- Source folder
- Read status
- Delivery status
- Update
- SSL/TLS version (inbound)
- SSL/TLS version (outbound)
- Delivery failure reason
- Message
encrypt
event
kevent
spam
statistics
- default
  - 0200000000 GENERIC
  - 0200000001 HISTORY
- update
  - 0201000002 HISTORY_UPDATE
virus
Change log

Home FortiMail Appliance and VM 8.0.0 Log Reference

8.0.0

Client country code/location

The client_cc field is in FortiMail log messages where type=statistics.

The field indicates the geographical location associated with the SMTP client's IP address (client_ip) according to the FortiGuard GeoIP database. Public network IP addresses have an associated country code, such as client_cc="DE" for Germany. Private network IP addresses (RFC 1918) are not globally unique and therefore cannot be definitively associated with any known location, and so they use the reserved country code (client_cc="ZZ").