FortiGate Administration Guide - FirewallShop.com

Log types
Log&Report
Enabling traffic logging
Traffic logging records any traffic to or from the interface or VLAN subinterface.
You need to set the logging severity level to Notification or lower to record traffic
logs.
To enable traffic logging for an interface or VLAN subinterface
1 Go to System > Network > Interface.
2 Select the Edit icon for an interface.
3 Select Log.
4 Select OK.
Enabling firewall policy traffic logging
Firewall policy traffic logging records the traffic that is both permitted and denied
by the firewall policy, based on the protection profile.
To enable firewall policy traffic logging
1 Go to Firewall > Policy.
2 Select the blue arrow to expand the policy list for a policy.
3 Select the Edit icon.
If required, create a new firewall policy by selecting Create.
4 Select Log Allowed Traffic.
5 Select OK.
Event log
The Event Log records management and activity events. For example, when a
configuration has changed, or VPN and High Availability (HA) events occur.
To enable the event logs
1 Go to Log&Report > Log Config > Event Log.
2 Select from the following logs:
System Activity
event
IPSec negotiation
event
DHCP service
event
L2TP/PPTP/PPPoE
service event
Admin event
HA activity event
Firewall
authentication
event
The FortiGate unit logs all system-related events, such as ping
server failure and gateway status.
The FortiGate unit logs all IPSec negotiation events, such as
progress and error reports.
The FortiGate unit logs all DHCP-events, such as the request and
response log.
The FortiGate unit logs all protocol-related events, such as
manager and socket creation processes.
The FortiGate unit logs all administrative events, such as user
logins, resets, and configuration updates.
The FortiGate unit logs all high availability events, such as link,
member, and state information.
The FortiGate unit logs all firewall-related events, such as user
authentication.
FortiGate Version 3.0 MR5 Administration Guide
482 01-30005-0203-20070830