The other is ‘Reserved’, reserved means RFC1918 or any other that remains reserved.Ĭraction=131072 – Client Reputation Actionĭevcategory=Windows Device – Device Category is the pre-defined device category.ĭevtype=Windows PC – This field is the OS Fingerprint of the deviceĭstip=1.1.16.43 – Here is the destination IP address that the source was trying to connect to.Ĭrscore=30 – This is the ‘Client Reputation Score’ Srccountry=Reserved – A couple of things here, the first is the category of ‘srrcountry’ which defines the country of origin. Rcvdbyte=0 – Number of bytes received, in our example, that would be ‘0’. If you are not using VDOMS, then it will alays be ‘root’ Vd=root – This is the VDOM the log was received from.

Itime= 19:30:12 – is generated by FAZ when it receives a log (with SQL enabled) i.e. In this section, we are going to break down the pieces of the log. It is a central logging facility with the added feature of beautiful reports that can be scheduled and sent out automatically. The FortiAnalyzer is an application from Fortinet that aids in displaying information about the logs generated by the Fortigates and other Fortinet solutions. itime= 19:30:12 vd=root rcvdbyte=0 srccountry=Reserved craction=131072 devcategory=Windows Device date= devtype=Windows PC dstip=1.1.16.43Ĭrscore=30 srcintfrole=lan duration=0 sentbyte=0 logid=0000000013 crlevel=high srcmac=00:0c:29:5a:be:ef service=DNS proto=17 devid=FG3H0E5 policytype=policy poluuid=3ef8fc44-3850-51e9-7638-8b5bbf1c560a idseq=79516894796709890 dstport=53 type=traffic eventtime=1552444212 devname=LAB-FW-01 dstintfrole=wan dtime= 22:30:12 trandisp=noop osname=Windows 8.1 / 2012 sessionid=56774108 itime_t=1552444212 dstintf=port1 srcintf=Servers srcip=10.1.106.39 sentpkt=0 level=notice appcat=unscanned srcport=63117 srcserver=0 srcname=WIN-EC9R2A1AT61 subtype=forward dstcountry=China time=22:30:12 action=deny mastersrcmac=00:0c:29:5a:b6:a2 policyid=39Ībove, we have a single raw log entry from my FortiAnalyzer.

I will be referencing the FortiOS Log Reference Guide which is available via PDF from the Fortinet Site. In this blog post, we are going to analyze some log files from my Fortigate to describe the different sections of the log, what they mean and how to interpret them.

How clear logs fortigate