FortiGate Administration Guide - FirewallShop.com

Log&Report
Configuring FortiGuard Analysis Service
Logging to a FortiGuard Analysis server
You can configure logging to a FortiGuard Analysis server after registering your
account. It is recommended to ensure the connection between your FortiGate unit
and FortiGuard Analysis server is working properly before configuring logging.
You can enable logging of FortiGate features from the FortiGate web-based
manager. See “Log types” on page 481 for more information. Traffic and full
content archiving will be supported in future releases.
To configure logging to a FortiGuard Analysis server
1 Log into the web-based manager of the FortiGate unit you want registered.
1 Go to Log&Report > Log Config.
2 Select the FortiGuard Analysis Service checkbox.
3 Select the blue arrow to expand the FortiGuard Analysis Service options.
4 Select one of the following:
overwrite
Do not log
Select to delete the oldest log entry and continue logging when the
maximum log disk space is reached.
Select to stop log message going to the FortiGuard Analysis
server when the maximum log disk space is reached.
5 Select a log severity level.
6 Select Apply.
Accessing logs on the FortiGuard Analysis server
The FortiGuard Analysis server provides both real-time and historical views of log
messages. Real-time logs display log information and updates continually,
providing recent updates and events occurring on the FortiGate unit. Historical
logs display log information for a selected device and log type for a specific time
range.
To access real-time logs
1 Log into the portal.
2 Go to Log > Log Viewer > Real-time.
3 Select a device in Devices.
4 Select a log type in Log types.
5 Select OK.
If you want to change what log type you are currently viewing, select change, next
to the Type name. You can also stop real-time logs by selecting Stop. When you
want to start real-time logs again, select Start. The option Start only displays when
you have selected Stop.
To access historical logs
1 Log into the portal.
2 Go to Log > Log Viewer > Historical.
3 Select the Historical tab.
4 Select a device in Devices.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 479