FortiGate Firewall: Logging and Reporting

FortiGate firewalls generate a variety of log messages to help administrators monitor, audit, and troubleshoot network activity. Understanding these log types is essential for effective security management and compliance.

• Event Logs:
  Record system events such as administrator logins, configuration changes, and device status updates. Useful for tracking changes and auditing administrative actions.
• Traffic Logs:
  Capture details about network traffic that is allowed or denied by firewall policies. These logs provide visibility into source/destination IPs, ports, protocols, and actions taken.
• Security Logs:
  Log events detected by security modules like Intrusion Prevention System (IPS), antivirus, web filtering, and application control. They help identify threats and policy violations.
• UTM Logs:
  Unified Threat Management logs cover advanced features such as Data Loss Prevention (DLP), spam filtering, and vulnerability scanning. They are crucial for compliance and advanced threat detection.
• System Logs:
  Document hardware status, system resource usage, and service operations. These logs are essential for diagnosing device health and performance issues.

FortiGate firewall logs contain a variety of fields that provide detailed information about each logged event. Understanding these key fields is crucial for effective monitoring, troubleshooting, and compliance.

• Date/Time:
  Indicates when the log entry was recorded, including both the date and the time of the event.
• Source IP (srcip):
  The IP address from which the traffic or event originated.
• Destination IP (dstip):
  The IP address targeted by the traffic or event.
• Source Port (srcport):
  The port number used by the source device.
• Destination Port (dstport):
  The port number on the destination device.
• Action (action):
  The result of the event, such as allow, deny, or close.
• Policy ID (policyid):
  The identifier of the firewall policy that matched the traffic or event.
• Service (service):
  The protocol or application involved (e.g., HTTPS, FTP).
• Severity/Level (level):
  Indicates the importance or risk level of the event, such as notice, warning, or critical.
• Session ID (sessionid):
  Unique identifier for the network session associated with the log entry.
• Virtual Domain (vd):
  The name of the virtual domain (VDOM) where the log was generated, useful in multi-tenant environments.

FortiGate firewalls offer several log storage options to suit different needs for retention, compliance, and analysis. Choosing the right storage method depends on your hardware, network size, and regulatory requirements.

• Local Disk:
  Logs are stored directly on the FortiGate device, either in system memory, flash, or an onboard hard drive (if available). Local storage is limited by device capacity and is best for short-term retention or small deployments. Logs older than a set period (default: 7 days) are automatically deleted to free up space. Disk logging must be enabled, and constant rewrites can reduce flash memory lifespan. Not all models support disk logging[1][3][5].
• FortiAnalyzer:
  A dedicated, centralized appliance or virtual machine for log collection, storage, and advanced analytics. FortiAnalyzer provides long-term retention, powerful search, reporting, and event correlation. It is ideal for organizations with multiple Fortinet devices or compliance needs[1][5][6].
• Syslog Server:
  Logs can be sent to external syslog servers for aggregation, long-term storage, and integration with third-party SIEM solutions. Up to four syslog or FortiSIEM servers can be configured. Syslog supports multiple formats (CSV, CEF, RFC5424, JSON) for compatibility[1][5].
• FortiCloud:
  Cloud-based log storage and analytics managed by Fortinet. The free tier stores logs for 7 days, while paid subscriptions extend retention up to 1 year. FortiCloud is easy to deploy, reduces on-premises storage needs, and allows access to logs from anywhere[1][10][13].

FortiGate firewalls provide a variety of reporting features that help administrators analyze log data, monitor network activity, and ensure compliance with security policies.

• Predefined Reports:
  Built-in report templates covering traffic patterns, security events, compliance checks, and usage statistics. These reports offer quick insights without the need for customization.
• Custom Reports:
  Allows users to create tailored reports by selecting specific filters, data fields, and chart types to meet unique organizational requirements.
• Scheduled Reports:
  Automates report generation and delivery via email or other methods on a set schedule, ensuring stakeholders receive timely updates.
• Drill-down Analysis:
  Interactive reports that enable users to explore summarized data in detail, facilitating root cause analysis and deeper understanding of network events.

Troubleshooting logging and reporting issues on FortiGate firewalls involves a systematic approach to identify and resolve common problems that prevent logs from being generated, stored, or displayed correctly.

1. Verify Logging Is Enabled:
   Ensure logging is enabled both globally and within each relevant firewall policy or UTM profile. Without this, traffic and event logs will not be generated.
2. Check Log Storage and Retention:
   Confirm there is sufficient disk space on the device or that external log storage (FortiAnalyzer, Syslog, FortiCloud) is reachable and configured correctly. Review log retention settings to avoid automatic deletion of important logs.
3. Validate Connectivity to Log Devices:
   If using external log storage, use tools like execute ping to test connectivity. Ensure IP addresses, credentials, and ports are correct for FortiAnalyzer, Syslog, or FortiCloud destinations.
4. Review Log Filters and Severity Levels:
   Make sure log filters and severity levels are set appropriately. Filtering out certain levels (e.g., only logging critical events) may hide important information needed for troubleshooting.
5. Inspect Log Settings in the GUI:
   Go to Log & Report sections (e.g., Web Filter, Application Control) to confirm logs are being generated. If logs are missing from the GUI, check that the correct log source is selected under Log Settings.
6. Restart Logging Daemon if Needed:
   If logs suddenly stop appearing, restart the logging daemon using CLI commands or reboot the device if necessary.
7. Clear and Rebuild Log Databases:
   For GUI display issues, use commands like execute report flush-cache and execute report recreate-db to clear and rebuild reporting databases.
8. Compare Logs to Baseline:
   Compare current logs to a known baseline of normal operation. This helps identify anomalies or missing log types.

Useful CLI Commands for Troubleshooting:

# Check log device status
diagnose log device

# Test connectivity to external log device
execute ping <log_device_ip>

# View log filters and settings
show log

# Restart logging daemon (Miglogd)
diagnose sys kill 11 <PID_of_miglogd>

# Clear and rebuild reporting database
execute report flush-cache
execute report recreate-db

FortiGate firewalls provide a robust command-line interface (CLI) that enables administrators to perform advanced troubleshooting, configuration, and monitoring tasks related to logging and reporting. Below are some essential CLI commands commonly used to manage and diagnose log and reporting functions.

• Check Log Device Status:
  diagnose log device
  Displays the status of log storage devices (local disk, FortiAnalyzer, etc.) and their available space.
• Filter Logs by Criteria:
  execute log filter field <field> <value>
  Sets filters to narrow down logs based on specific fields like source IP, destination IP, or action.
• Display Filtered Logs:
  execute log display
  Shows the logs that match the previously set filters.
• Enable Debug Logging:
  diagnose debug enable
  Activates debug mode for troubleshooting log-related issues.
• Debug Logging Application:
  diagnose debug application logd -1
  Enables detailed debugging for the logging daemon to help identify issues with log generation or forwarding.
• Show Log Settings:
  show log
  Displays the current log configuration on the device.
• Restart Logging Daemon:
  diagnose sys kill 11 <PID_of_miglogd>
  Restarts the logging process if logs are not being generated or forwarded.
• Clear and Rebuild Reporting Database:
  execute report flush-cache
execute report recreate-db
  Used if there are issues with report generation or log display in the GUI.

Note: Use these commands with caution, especially on production systems. Always review official Fortinet documentation for your specific FortiOS version before making changes.