Configuring Log Filters; Enabling Traffic Logging - Fortinet FortiGate FortiGate-60 Administration Manual

Log config

Configuring log filters

Enabling traffic logging

358
Attack log
The Attack Log records attacks detected and prevented by the FortiGate unit. You can
apply the following filters:
Attack Signature
Attack Anomaly
Spam filter log
The Spam Filter Log records blocking of address patterns and content in IMAP and
POP3 traffic. You can apply the following filters:
SMTP
POP3
IMAP
Configure log filters for each location to which you are saving logs.
To configure log filters
1 Go to Log&Report > Log Config > Log Filter.
2 Enable the logging type for each location to which you want to log messages.
3 Select the specific log sub-types to log for each location.
4 Select Apply.
To enable traffic logging for an interface or VLAN subinterface
You can enable traffic logging for an interface or VLAN subinterface. All connections
to and through the interface are recorded in the traffic log.
Note: To record traffic log messages you must set the logging severity level to Notification when
configuring the logging location. Traffic log messages do not generally have a severity level
higher than Notification.
1 Go to System > Network > Interface.
2 Select the Edit icon for an interface.
3 Select Log.
4 Select OK.
5 Repeat steps 1 through 4 for each interface for which you want to enable logging.
6 Make sure you enable traffic logs for a logging location and set the logging severity
level to Notification or lower.
The FortiGate unit logs all detected and prevented attacks based on the
attack signature, and the action taken by the FortiGate unit.
The FortiGate unit logs all detected and prevented attacks based on
unknown or suspicious traffic patterns, and the action taken by the
FortiGate unit.
The FortiGate unit logs all instances of blocked email in SMTP traffic.
The FortiGate unit logs all instances of blocked email in POP3 traffic.
The FortiGate unit logs all instances of blocked email in IMAP traffic.
01-28006-0002-20041105
Log & Report
Fortinet Inc.