Fortinet black logo

CLI Reference

log

log

Use the following commands to configure log settings.

log alert

Use this command to configure log based alert settings.

Syntax

config system log alert

set max-alert-count <integer>

end

Variable

Description

max-alert-count <integer>

Maximum number of alerts supported. Range: 100 to 1000

log ioc

Use this command to configure log based IoC (Indicators of Compromise) settings.

Syntax

config system log ioc

set notification {enable | disable}

set notification-throttle <integer>

set status

end

Variable

Description

notification {enable | disable}

Enable / disable IoC notification (default = enable).

notification-throttle <integer>

Set the minute value for throttling the rate of IoC notifications (1 - 10080, default = 1440).

status

Enable / disable the IoC feature (default = enable).

log mail-domain

Use this command to configure FortiMail domain settings.

Syntax

config system log mail-domain

edit <id>

set devices <string>

set domain <string>

set vdom <string>

end

Variable

Description

<id>

The ID of the FortiMail domain.

devices <string>

The device IDs seperated by commas, or All_FortiMails,for domain to VDOM mapping.

For example: FEVM020000000000,FEVM020000000001

domain <string>

The FortiMail domain.

vdom <string>

The VDOM name that is mapping to the FortiMail domain.

log settings

Use this command to configure settings for logs.

Syntax

config system log settings

set dns-resolve-dstip {disable | enable}

set download-max-logs <integer>

set FAC-custom-field1 <string>

set FCH-custom-field1 <string>

set FCT-custom-field1 <string>

set FDD-custom-field1 <string>

set FGT-custom-field1 <string>

set FML-custom-field1 <string>

set FMG-custom-field1 <string>

set FWB-custom-field1 <string>

set FAZ-custom-field1 <string>

set FSA-custom-field1 <string>

set ha-auto-migrate {disable | enable}

set browse-max-logfiles <integer>

set import-max-logfiles <integer>

set log-file-archive-name {basic | extended}

set sync-search-timeout <integer>

config rolling-regular

set days {fri | mon| sat | sun | thu | tue | wed}

set del-files {disable | enable}

set directory <string>

set file-size <integer>

set gzip-format {disable | enable}

set hour <integer>

set ip <ipv4_address>

set ip2 <ipv4_address>

set ip3 <ipv4_address>

set log-format {csv | native | text}

set min <integer>

set password <passwd>

set password2 <passwd>

set password3 <passwd>

set server-type {ftp | scp | sftp}

set upload {disable | enable}

set upload-hour <integer>

set upload-mode {backup | mirror}

set upload-trigger {on-roll | on-schedule}

set username <string>

set username2 <string>

set username3 <string>

set when {daily | none | weekly}

end

end

Variable

Description

dns-resolve-stip {disable | enable}

Enable/Disable resolving destination IP by DNS. Default: enable.

download-max-logs <integer>

Maximum number of logs for each log download attempt. Default: 500000.

FAC-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FCH-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FCT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FDD-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FGT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FML-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FMG-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FWB-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FAZ-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FSA-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

ha-auto-migrate {disable | enable}

Enabled/Disable automatically merging HA member's logs to HA cluster. Default: disabled.

browse-max-logfiles <integer>

Maximum number of log files for each log browse attempt, per ADOM. Default: 10000.

import-max-logfiles <integer>

Maximum number of log files for each log import attempt. Default: 10000.

log-file-archive-name {basic | extended}

Log file name format for archiving.

  • basic: (Default) Basic format for log archive file name, for example:

    FGT20C0000000001.tlog.1417797247.log.

  • extended: Extended format for log archive file name, for example:

    FGT20C0000000001.2014-12-05-08:34:58.tlog.1417797247.log.

sync-search-timeout <integer>

The maximum number of seconds that a log search session can run in synchronous mode. Default: 60 seconds.

Variables for config rolling-regularsubcommand:

days {fri | mon| sat | sun | thu | tue | wed}

Log files rolling schedule (days of the week). When when is set to weekly, you can configure days, hour, and min values. the following options are available:

  • fri: Friday.
  • mon: Monday.
  • sat: Saturday.
  • sun: Sunday.
  • thu: Thursday.
  • tue: Tuesday.
  • wed: Wednesday.

del-files {disable | enable}

Enable/disable log file deletion after uploading.

directory <string>

The upload server directory. Character limit: 127

file-size <integer>

Roll log files when they reach this size (MB). Range: 10 to 500 (MB). Default: 200 (MB)

gzip-format {disable | enable}

Enable/disable compression of uploaded log files.

hour <integer>

Log files rolling schedule (hour).

ip <ipv4_address>

ip2 <ipv4_address>

ip3 <ipv4_address>

Upload server IPv4 addresses. Configure up to three servers.

log-format {csv | native | text}

Format of uploaded log files. The following options are available:

  • csv: CSV (comma-separated value) format.
  • native: Native format (text or compact).
  • text: Text format (convert if necessary).

min <integer>

Log files rolling schedule (minutes).

password <passwd>

password2 <passwd>

password3 <passwd>

Upload server login passwords. Character limit: 128

server-type {ftp | scp | sftp}

Upload server type: ftp, scp, or sftp.

upload {disable | enable}

Enable/disable log file uploads.

upload-hour <integer>

Log files upload schedule (hour).

upload-mode {backup | mirror}

Configure upload mode with multiple servers. Servers are attempted and used one after the other upon failure to connect. The following options are available:

  • backup: Servers are attempted and used one after the other upon failure to connect.
  • mirror: All configured servers are attempted and used.

upload-trigger {on-roll | on-schedule}

Event triggering log files upload:

  • on-roll: Upload log files after they are rolled.
  • on-schedule: Upload log files daily.

username <string>

username2 <string>

username3 <string>

Upload server login usernames. Character limit: 35

when {daily | none | weekly}

Roll log files periodically. The following options are available:

  • daily: Roll log files daily.
  • none: Do not roll log files periodically.
  • weekly: Roll log files on certain days of week.

log

Use the following commands to configure log settings.

log alert

Use this command to configure log based alert settings.

Syntax

config system log alert

set max-alert-count <integer>

end

Variable

Description

max-alert-count <integer>

Maximum number of alerts supported. Range: 100 to 1000

log ioc

Use this command to configure log based IoC (Indicators of Compromise) settings.

Syntax

config system log ioc

set notification {enable | disable}

set notification-throttle <integer>

set status

end

Variable

Description

notification {enable | disable}

Enable / disable IoC notification (default = enable).

notification-throttle <integer>

Set the minute value for throttling the rate of IoC notifications (1 - 10080, default = 1440).

status

Enable / disable the IoC feature (default = enable).

log mail-domain

Use this command to configure FortiMail domain settings.

Syntax

config system log mail-domain

edit <id>

set devices <string>

set domain <string>

set vdom <string>

end

Variable

Description

<id>

The ID of the FortiMail domain.

devices <string>

The device IDs seperated by commas, or All_FortiMails,for domain to VDOM mapping.

For example: FEVM020000000000,FEVM020000000001

domain <string>

The FortiMail domain.

vdom <string>

The VDOM name that is mapping to the FortiMail domain.

log settings

Use this command to configure settings for logs.

Syntax

config system log settings

set dns-resolve-dstip {disable | enable}

set download-max-logs <integer>

set FAC-custom-field1 <string>

set FCH-custom-field1 <string>

set FCT-custom-field1 <string>

set FDD-custom-field1 <string>

set FGT-custom-field1 <string>

set FML-custom-field1 <string>

set FMG-custom-field1 <string>

set FWB-custom-field1 <string>

set FAZ-custom-field1 <string>

set FSA-custom-field1 <string>

set ha-auto-migrate {disable | enable}

set browse-max-logfiles <integer>

set import-max-logfiles <integer>

set log-file-archive-name {basic | extended}

set sync-search-timeout <integer>

config rolling-regular

set days {fri | mon| sat | sun | thu | tue | wed}

set del-files {disable | enable}

set directory <string>

set file-size <integer>

set gzip-format {disable | enable}

set hour <integer>

set ip <ipv4_address>

set ip2 <ipv4_address>

set ip3 <ipv4_address>

set log-format {csv | native | text}

set min <integer>

set password <passwd>

set password2 <passwd>

set password3 <passwd>

set server-type {ftp | scp | sftp}

set upload {disable | enable}

set upload-hour <integer>

set upload-mode {backup | mirror}

set upload-trigger {on-roll | on-schedule}

set username <string>

set username2 <string>

set username3 <string>

set when {daily | none | weekly}

end

end

Variable

Description

dns-resolve-stip {disable | enable}

Enable/Disable resolving destination IP by DNS. Default: enable.

download-max-logs <integer>

Maximum number of logs for each log download attempt. Default: 500000.

FAC-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FCH-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FCT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FDD-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FGT-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FML-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FMG-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FWB-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FAZ-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

FSA-custom-field1 <string>

Enter a name of the custom log field to index. Character limit: 31

ha-auto-migrate {disable | enable}

Enabled/Disable automatically merging HA member's logs to HA cluster. Default: disabled.

browse-max-logfiles <integer>

Maximum number of log files for each log browse attempt, per ADOM. Default: 10000.

import-max-logfiles <integer>

Maximum number of log files for each log import attempt. Default: 10000.

log-file-archive-name {basic | extended}

Log file name format for archiving.

  • basic: (Default) Basic format for log archive file name, for example:

    FGT20C0000000001.tlog.1417797247.log.

  • extended: Extended format for log archive file name, for example:

    FGT20C0000000001.2014-12-05-08:34:58.tlog.1417797247.log.

sync-search-timeout <integer>

The maximum number of seconds that a log search session can run in synchronous mode. Default: 60 seconds.

Variables for config rolling-regularsubcommand:

days {fri | mon| sat | sun | thu | tue | wed}

Log files rolling schedule (days of the week). When when is set to weekly, you can configure days, hour, and min values. the following options are available:

  • fri: Friday.
  • mon: Monday.
  • sat: Saturday.
  • sun: Sunday.
  • thu: Thursday.
  • tue: Tuesday.
  • wed: Wednesday.

del-files {disable | enable}

Enable/disable log file deletion after uploading.

directory <string>

The upload server directory. Character limit: 127

file-size <integer>

Roll log files when they reach this size (MB). Range: 10 to 500 (MB). Default: 200 (MB)

gzip-format {disable | enable}

Enable/disable compression of uploaded log files.

hour <integer>

Log files rolling schedule (hour).

ip <ipv4_address>

ip2 <ipv4_address>

ip3 <ipv4_address>

Upload server IPv4 addresses. Configure up to three servers.

log-format {csv | native | text}

Format of uploaded log files. The following options are available:

  • csv: CSV (comma-separated value) format.
  • native: Native format (text or compact).
  • text: Text format (convert if necessary).

min <integer>

Log files rolling schedule (minutes).

password <passwd>

password2 <passwd>

password3 <passwd>

Upload server login passwords. Character limit: 128

server-type {ftp | scp | sftp}

Upload server type: ftp, scp, or sftp.

upload {disable | enable}

Enable/disable log file uploads.

upload-hour <integer>

Log files upload schedule (hour).

upload-mode {backup | mirror}

Configure upload mode with multiple servers. Servers are attempted and used one after the other upon failure to connect. The following options are available:

  • backup: Servers are attempted and used one after the other upon failure to connect.
  • mirror: All configured servers are attempted and used.

upload-trigger {on-roll | on-schedule}

Event triggering log files upload:

  • on-roll: Upload log files after they are rolled.
  • on-schedule: Upload log files daily.

username <string>

username2 <string>

username3 <string>

Upload server login usernames. Character limit: 35

when {daily | none | weekly}

Roll log files periodically. The following options are available:

  • daily: Roll log files daily.
  • none: Do not roll log files periodically.
  • weekly: Roll log files on certain days of week.