FortiOS - Log Reference

Version 6.0.10
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com

FORTINET VIDEO GUIDE

https://video.fortinet.com

FORTINET BLOG
https://blog.fortinet.com

CUSTOMER SERVICE & SUPPORT

https://support.fortinet.com

FORTINET TRAINING & CERTIFICATION PROGRAM

https://www.fortinet.com/support-and-training/training.html

NSE INSTITUTE
https://training.fortinet.com

FORTIGUARD CENTER
https://fortiguard.com/

END USER LICENSE AGREEMENT

https://www.fortinet.com/doc/legal/EULA.pdf

FEEDBACK
Email: [email protected]

June 18, 2020

FortiOS 6.0.10 Log Reference
01-6010-478339-20200618
TABLE OF CONTENTS

Change Log 26
Introduction 27
Before you begin 27
Overview 27
What's new 28
FortiOS 6.0.10 28
FortiOS 6.0.9 28
FortiOS 6.0.8 28
FortiOS 6.0.7 28
FortiOS 6.0.6 28
FortiOS 6.0.5 28
FortiOS 6.0.4 28
FortiOS 6.0.3 28
FortiOS 6.0.2 28
FortiOS 6.0.1 29
FortiOS 6.0.0 29
Log Types and Subtypes 30
Type 30
Subtype 30
List of log types and subtypes 30
UTM log subtypes 31
FortiOS priority levels 32
Log field format 33
Log Schema Structure 34
Log message fields 34
Log ID numbers 37
Log ID definitions 38
FortiGuard Web Filter Categories 40
CEF Support 43
FortiOS to CEF log field mapping guidelines 43
CEF priority levels 44
Examples of CEF support 44
Traffic log support for CEF 44
Event log support for CEF 46
Antivirus log support for CEF 47
Webfilter log support for CEF 48
IPS log support for CEF 49
Email Spamfilter log support for CEF 49
Anomaly log support for CEF 50
VoIP log support for CEF 50
DLP log support for CEF 51
Application log support for CEF 52
WAF log support for CEF 52

FortiOS 6.0.10 Log Reference 3

Fortinet, Inc.
DNS log support for CEF 52
SSH log support for CEF 53
UTM Extended Logging 54
Enabling extended logging 54
Extended logging option in UTM profiles 54
Syslog server mode 55
Example of an extended log 55
Log Messages 56
Anomaly 56
18432 - LOGID_ATTCK_ANOMALY_TCP_UDP 56
18433 - LOGID_ATTCK_ANOMALY_ICMP 57
18434 - LOGID_ATTCK_ANOMALY_OTHERS 59
App 61
28672 - LOGID_APP_CTRL_IM_BASIC 61
28673 - LOGID_APP_CTRL_IM_BASIC_WITH_STATUS 62
28674 - LOGID_APP_CTRL_IM_BASIC_WITH_COUNT 63
28675 - LOGID_APP_CTRL_IM_FILE 65
28676 - LOGID_APP_CTRL_IM_CHAT 66
28677 - LOGID_APP_CTRL_IM_CHAT_BLOCK 67
28678 - LOGID_APP_CTRL_IM_BLOCK 69
28704 - LOGID_APP_CTRL_IPS_PASS 70
28705 - LOGID_APP_CTRL_IPS_BLOCK 72
28706 - LOGID_APP_CTRL_IPS_RESET 74
28720 - LOGID_APP_CTRL_SSH_PASS 76
28721 - LOGID_APP_CTRL_SSH_BLOCK 77
AV 79
8192 - MESGID_INFECT_WARNING 79
8193 - MESGID_INFECT_NOTIF 81
8194 - MESGID_INFECT_MIME_WARNING 83
8195 - MESGID_INFECT_MIME_NOTIF 85
8200 - MESGID_MIME_FILETYPE_EXE_WARNING 86
8201 - MESGID_MIME_FILETYPE_EXE_NOTIF 88
8448 - MESGID_BLOCK_WARNING 90
8449 - MESGID_BLOCK_NOTIF 92
8450 - MESGID_BLOCK_MIME_WARNING 94
8451 - MESGID_BLOCK_MIME_NOTIF 96
8452 - MESGID_BLOCK_COMMAND 97
8453 - MESGID_INTERCEPT 99
8454 - MESGID_INTERCEPT_MIME 101
8455 - MESGID_EXEMPT 102
8456 - MESGID_EXEMPT_MIME 104
8457 - MESGID_MMS_CHECKSUM 106
8458 - MESGID_MMS_CHECKSUM_NOTIF 107
8704 - MESGID_OVERSIZE_WARNING 109
8705 - MESGID_OVERSIZE_NOTIF 111
8706 - MESGID_OVERSIZE_MIME_WARNING 112
8707 - MESGID_OVERSIZE_MIME_NOTIF 114
8720 - MESGID_SWITCH_PROTO_WARNING 116

FortiOS 6.0.10 Log Reference 4

Fortinet, Inc.
8721 - MESGID_SWITCH_PROTO_NOTIF 117
8960 - MESGID_SCAN_UNCOMPSIZELIMIT_WARNING 119
8961 - MESGID_SCAN_UNCOMPSIZELIMIT_NOTIF 121
8962 - MESGID_SCAN_ARCHIVE_ENCRYPTED_WARNING 122
8963 - MESGID_SCAN_ARCHIVE_ENCRYPTED_NOTIF 124
8964 - MESGID_SCAN_ARCHIVE_CORRUPTED_WARNING 126
8965 - MESGID_SCAN_ARCHIVE_CORRUPTED_NOTIF 128
8966 - MESGID_SCAN_ARCHIVE_MULTIPART_WARNING 130
8967 - MESGID_SCAN_ARCHIVE_MULTIPART_NOTIF 132
8968 - MESGID_SCAN_ARCHIVE_NESTED_WARNING 134
8969 - MESGID_SCAN_ARCHIVE_NESTED_NOTIF 136
8970 - MESGID_SCAN_ARCHIVE_OVERSIZE_WARNING 137
8971 - MESGID_SCAN_ARCHIVE_OVERSIZE_NOTIF 139
8972 - MESGID_SCAN_ARCHIVE_UNHANDLED_WARNING 141
8973 - MESGID_SCAN_ARCHIVE_UNHANDLED_NOTIF 143
8974 - MESGID_SCAN_AV_ENGINE_LOAD_FAILED_ERROR 145
8975 - MESGID_SCAN_ARCHIVE_PARTIALLYCORRUPTED_WARNING 147
8976 - MESGID_SCAN_ARCHIVE_PARTIALLYCORRUPTED_NOTIF 149
8977 - MESGID_SCAN_ARCHIVE_FILESLIMIT_WARNING 151
8978 - MESGID_SCAN_ARCHIVE_FILESLIMIT_NOTIF 152
8979 - MESGID_SCAN_ARCHIVE_TIMEOUT_WARNING 154
8980 - MESGID_SCAN_ARCHIVE_TIMEOUT_NOTIF 156
9233 - MESGID_ANALYTICS_SUBMITTED 158
9234 - MESGID_ANALYTICS_INFECT_WARNING 160
9235 - MESGID_ANALYTICS_INFECT_NOTIF 162
9236 - MESGID_ANALYTICS_INFECT_MIME_WARNING 164
9237 - MESGID_ANALYTICS_INFECT_MIME_NOTIF 166
9238 - MESGID_ANALYTICS_FSA_RESULT 168
9239 - MESGID_CONTENT_DISARM_NOTIF 169
9240 - MESGID_CONTENT_DISARM_WARNING 171
9248 - MESGID_BOTNET_WARNING 172
9249 - MESGID_BOTNET_NOTIF 174
DLP 176
24576 - LOG_ID_DLP_WARN 176
24577 - LOG_ID_DLP_NOTIF 178
24578 - LOG_ID_DLP_DOC_SOURCE 180
24579 - LOG_ID_DLP_DOC_SOURCE_ERROR 181
DNS 182
54000 - LOG_ID_DNS_QUERY 182
54200 - LOG_ID_DNS_RESOLV_ERROR 183
54400 - LOG_ID_DNS_URL_FILTER_BLOCK 185
54401 - LOG_ID_DNS_URL_FILTER_ALLOW 186
54600 - LOG_ID_DNS_BOTNET_IP 188
54601 - LOG_ID_DNS_BOTNET_DOMAIN 189
54800 - LOG_ID_DNS_FTGD_WARNING 191
54801 - LOG_ID_DNS_FTGD_ERROR 192
54802 - LOG_ID_DNS_FTGD_CAT_ALLOW 194
54803 - LOG_ID_DNS_FTGD_CAT_BLOCK 195
Email 197

FortiOS 6.0.10 Log Reference 5

Fortinet, Inc.
20480 - LOGID_ANTISPAM_EMAIL_SMTP_NOTIF 197
20481 - LOGID_ANTISPAM_EMAIL_SMTP_BWORD_NOTIF 199
20482 - LOGID_ANTISPAM_EMAIL_POP3_NOTIF 200
20483 - LOGID_ANTISPAM_EMAIL_POP3_BWORD_NOTIF 202
20484 - LOGID_ANTISPAM_EMAIL_IMAP_NOTIF 204
20485 - LOGID_ANTISPAM_ENDPOINT_FILTER_WARNING 206
20486 - LOGID_ANTISPAM_ENDPOINT_FILTER_NOTIF 208
20487 - LOGID_ANTISPAM_ENDPOINT_MM7_WARNING 209
20488 - LOGID_ANTISPAM_ENDPOINT_MM7_NOTIF 211
20489 - LOGID_ANTISPAM_ENDPOINT_MM1_WARNING 213
20490 - LOGID_ANTISPAM_ENDPOINT_MM1_NOTIF 215
20491 - LOGID_ANTISPAM_EMAIL_IMAP_BWORD_NOTIF 217
20492 - LOGID_ANTISPAM_MM1_FLOOD_WARNING 218
20493 - LOGID_ANTISPAM_MM1_FLOOD_NOTIF 220
20494 - LOGID_ANTISPAM_MM4_FLOOD_WARNING 222
20495 - LOGID_ANTISPAM_MM4_FLOOD_NOTIF 224
20496 - LOGID_ANTISPAM_MM1_DUPE_WARNING 225
20497 - LOGID_ANTISPAM_MM1_DUPE_NOTIF 227
20498 - LOGID_ANTISPAM_MM4_DUPE_WARNING 229
20499 - LOGID_ANTISPAM_MM4_DUPE_NOTIF 231
20500 - LOGID_ANTISPAM_EMAIL_MSN_NOTIF 233
20501 - LOGID_ANTISPAM_EMAIL_YAHOO_NOTIF 234
20502 - LOGID_ANTISPAM_EMAIL_GOOGLE_NOTIF 236
20503 - LOGID_EMAIL_SMTP_GENERAL_NOTIF 238
20504 - LOGID_EMAIL_POP3_GENERAL_NOTIF 240
20505 - LOGID_EMAIL_IMAP_GENERAL_NOTIF 242
20506 - LOGID_EMAIL_MAPI_GENERAL_NOTIF 243
20507 - LOGID_ANTISPAM_EMAIL_MAPI_BWORD_NOTIF 245
20508 - LOGID_ANTISPAM_EMAIL_MAPI_NOTIF 247
20509 - LOGID_ANTISPAM_FTGD_ERR 249
Event 251
20002 - LOG_ID_DOMAIN_UNRESOLVABLE 251
20003 - LOG_ID_MAIL_SENT_FAIL 251
20004 - LOG_ID_POLICY_TOO_BIG 252
20005 - LOG_ID_PPP_LINK_UP 253
20006 - LOG_ID_PPP_LINK_DOWN 254
20007 - LOG_ID_SOCKET_EXHAUSTED 254
20008 - LOG_ID_POLICY6_TOO_BIG 255
20010 - LOG_ID_KERNEL_ERROR 256
20016 - LOG_ID_MODEM_EXCEED_REDIAL_COUNT 257
20017 - LOG_ID_MODEM_FAIL_TO_OPEN 257
20020 - LOG_ID_MODEM_USB_DETECTED 258
20021 - LOG_ID_MAIL_RESENT 258
20022 - LOG_ID_MODEM_USB_REMOVED 259
20023 - LOG_ID_MODEM_USBLTE_DETECTED 260
20024 - LOG_ID_MODEM_USBLTE_REMOVED 261
20025 - LOG_ID_REPORTD_REPORT_SUCCESS 261
20026 - LOG_ID_REPORTD_REPORT_FAILURE 262
20027 - LOG_ID_REPORT_DEL_OLD_REC 263

FortiOS 6.0.10 Log Reference 6

Fortinet, Inc.
20028 - LOG_ID_REPORT_RECREATE_DB 263
20031 - LOG_ID_RAD_OUT_OF_MEM 264
20032 - LOG_ID_RAD_NOT_FOUND 265
20033 - LOG_ID_RAD_MOBILE_IPV6 265
20034 - LOG_ID_RAD_IPV6_OUT_OF_RANGE 266
20035 - LOG_ID_RAD_MIN_OUT_OF_RANGE 266
20036 - LOG_ID_RAD_MAX_OUT_OF_RANGE 267
20037 - LOG_ID_RAD_MAX_ADV_OUT_OF_RANGE 268
20039 - LOG_ID_RAD_MTU_TOO_SMALL 268
20040 - LOG_ID_RAD_TIME_TOO_SMALL 269
20041 - LOG_ID_RAD_HOP_OUT_OF_RANGE 270
20042 - LOG_ID_RAD_DFT_HOP_OUT_OF_RANGE 270
20043 - LOG_ID_RAD_AGENT_OUT_OF_RANGE 271
20044 - LOG_ID_RAD_AGENT_FLAG_NOT_SET 272
20045 - LOG_ID_RAD_PREFIX_TOO_LONG 272
20046 - LOG_ID_RAD_PREF_TIME_TOO_SMALL 273
20047 - LOG_ID_RAD_FAIL_IPV6_SOCKET 274
20048 - LOG_ID_RAD_FAIL_OPT_IPV6_PKTINFO 274
20049 - LOG_ID_RAD_FAIL_OPT_IPV6_CHECKSUM 275
20050 - LOG_ID_RAD_FAIL_OPT_IPV6_UNICAST_HOPS 275
20051 - LOG_ID_RAD_FAIL_OPT_IPV6_MULTICAST_HOPS 276
20052 - LOG_ID_RAD_FAIL_OPT_IPV6_HOPLIMIT 277
20053 - LOG_ID_RAD_FAIL_OPT_IPPROTO_ICMPV6 277
20054 - LOG_ID_RAD_EXIT_BY_SIGNAL 278
20055 - LOG_ID_RAD_FAIL_CMDB_QUERY 279
20056 - LOG_ID_RAD_FAIL_CMDB_FOR_EACH 279
20057 - LOG_ID_RAD_FAIL_FIND_VIRT_INTF 280
20058 - LOG_ID_RAD_UNLOAD_INTF 281
20059 - LOG_ID_RAD_NO_PKT_INFO 281
20060 - LOG_ID_RAD_INV_ICMPV6_LEN 282
20061 - LOG_ID_RAD_INV_ICMPV6_TYPE 283
20062 - LOG_ID_RAD_INV_ICMPV6_RA_LEN 283
20063 - LOG_ID_RAD_ICMPV6_NO_SRC_ADDR 284
20064 - LOG_ID_RAD_INV_ICMPV6_RS_LEN 284
20065 - LOG_ID_RAD_INV_ICMPV6_CODE 285
20066 - LOG_ID_RAD_INV_ICMPV6_HOP 286
20067 - LOG_ID_RAD_MISMATCH_HOP 286
20068 - LOG_ID_RAD_MISMATCH_MGR_FLAG 287
20069 - LOG_ID_RAD_MISMATCH_OTH_FLAG 288
20070 - LOG_ID_RAD_MISMATCH_TIME 288
20071 - LOG_ID_RAD_MISMATCH_TIMER 289
20072 - LOG_ID_RAD_EXTRA_DATA 290
20073 - LOG_ID_RAD_NO_OPT_DATA 290
20074 - LOG_ID_RAD_INV_OPT_LEN 291
20075 - LOG_ID_RAD_MISMATCH_MTU 292
20077 - LOG_ID_RAD_MISMATCH_PREF_TIME 292
20078 - LOG_ID_RAD_INV_OPT 293
20079 - LOG_ID_RAD_READY 293
20080 - LOG_ID_RAD_FAIL_TO_RCV 294

FortiOS 6.0.10 Log Reference 7

Fortinet, Inc.
20081 - LOG_ID_RAD_INV_HOP 295
20082 - LOG_ID_RAD_INV_PKTINFO 295
20083 - LOG_ID_RAD_FAIL_TO_CHECK 296
20084 - LOG_ID_RAD_FAIL_TO_SEND 297
20085 - LOG_ID_SESSION_CLASH 297
20086 - LOG_ID_XH0_EVENT 298
20090 - LOG_ID_INTF_LINK_STA_CHG 299
20099 - LOG_ID_INTF_STA_CHG 299
20100 - LOG_ID_WEB_CAT_UPDATED 300
20101 - LOG_ID_WEB_LIC_EXPIRE 301
20102 - LOG_ID_SPAM_LIC_EXPIRE 301
20103 - LOG_ID_AV_LIC_EXPIRE 302
20104 - LOG_ID_IPS_LIC_EXPIRE 303
20105 - LOG_ID_LOG_UPLOAD_SKIP 303
20107 - LOG_ID_LOG_UPLOAD_ERR 304
20108 - LOG_ID_LOG_UPLOAD_DONE 305
20109 - LOG_ID_WEB_LIC_EXPIRED 306
20113 - LOG_ID_IPSA_DOWNLOAD_FAIL 306
20115 - LOG_ID_IPSA_STATUSUPD_FAIL 307
20116 - LOG_ID_SPAM_LIC_EXPIRED 308
20117 - LOG_ID_AV_LIC_EXPIRED 308
20118 - LOG_ID_WEBF_STATUS_REACH 309
20119 - LOG_ID_WEBF_STATUS_UNREACH 310
20200 - LOG_ID_FIPS_SELF_TEST 310
20201 - LOG_ID_FIPS_SELF_ALL_TEST 311
20202 - LOG_ID_DISK_FORMAT_ERROR 312
20203 - LOG_ID_DAEMON_SHUTDOWN 312
20204 - LOG_ID_DAEMON_START 313
20205 - LOG_ID_DISK_FORMAT_REQ 314
20206 - LOG_ID_DISK_SCAN_REQ 315
20207 - LOG_ID_RAD_MISMATCH_VALID_TIME 315
20208 - LOG_ID_ZOMBIE_DAEMON_CLEANUP 316
20209 - LOG_ID_DISK_UNAVAIL 317
20210 - LOG_ID_DISK_TRIM_START 317
20211 - LOG_ID_DISK_TRIM_END 318
20212 - LOG_ID_DISK_SCAN_NEEDED 319
20220 - LOGID_EVENT_SHAPER_OUTBOUND_MAXED_OUT 319
20221 - LOGID_EVENT_SHAPER_INBOUND_MAXED_OUT 320
20300 - LOG_ID_BGP_NB_STAT_CHG 321
20301 - LOG_ID_VZ_LOG 322
20302 - LOG_ID_OSPF_NB_STAT_CHG 322
20303 - LOG_ID_OSPF6_NB_STAT_CHG 323
20401 - LOG_ID_ROUTER_CLEAR 323
22000 - LOG_ID_INV_PKT_LEN 324
22001 - LOG_ID_UNSUPPORTED_PROT_VER 325
22002 - LOG_ID_INV_REQ_TYPE 326
22003 - LOG_ID_FAIL_SET_SIG_HANDLER 326
22004 - LOG_ID_FAIL_CREATE_SOCKET 327
22005 - LOG_ID_FAIL_CREATE_SOCKET_RETRY 327

FortiOS 6.0.10 Log Reference 8

Fortinet, Inc.
22006 - LOG_ID_FAIL_REG_CMDB_EVENT 328
22009 - LOG_ID_FAIL_FIND_AV_PROFILE 329
22010 - LOG_ID_SENDTO_FAIL 329
22011 - LOG_ID_ENTER_MEM_CONSERVE_MODE 330
22012 - LOG_ID_LEAVE_MEM_CONSERVE_MODE 331
22013 - LOG_ID_IPPOOLPBA_BLOCK_EXHAUSTED 332
22014 - LOG_ID_IPPOOLPBA_NATIP_EXHAUSTED 333
22015 - LOG_ID_IPPOOLPBA_CREATE 333
22016 - LOG_ID_IPPOOLPBA_DEALLOCATE 334
22017 - LOG_ID_EXCEED_GLOB_RES_LIMIT 335
22018 - LOG_ID_EXCEED_VD_RES_LIMIT 336
22020 - LOG_ID_FAIL_CREATE_HA_SOCKET 336
22021 - LOG_ID_FAIL_CREATE_HA_SOCKET_RETRY 337
22030 - LOG_ID_FAIL_CSF_LOG_SYNC_NO_VALID_FAZ 338
22031 - LOG_ID_SUCCESS_CSF_LOG_SYNC_CONFIG_CHANGED 338
22032 - LOG_ID_CSF_LOOP_FOUND 339
22033 - LOG_ID_FAIL_CSF_LOG_SYNC_NO_VALID_FSA 340
22035 - LOG_ID_CSF_UPSTREAM_SN_CHANGED 341
22100 - LOG_ID_QUAR_DROP_TRAN_JOB 342
22101 - LOG_ID_QUAR_DROP_TLL_JOB 342
22102 - LOG_ID_LOG_DISK_FAILURE 343
22103 - LOG_ID_QUAR_LIMIT_REACHED 344
22104 - LOG_ID_POWER_RESTORE 345
22105 - LOG_ID_POWER_FAILURE 345
22106 - LOG_ID_POWER_OPTIONAL_NOT_DETECTED 346
22107 - LOG_ID_VOLT_ANOM 347
22108 - LOG_ID_FAN_ANOM 347
22109 - LOG_ID_TEMP_TOO_HIGH 348
22110 - LOG_ID_SPARE_BLOCK_LOW 349
22113 - LOG_ID_FNBAM_FAILURE 350
22150 - LOG_ID_VOLT_NOM 350
22151 - LOG_ID_FAN_NOM 351
22152 - LOG_ID_TEMP_TOO_LOW 352
22153 - LOG_ID_TEMP_NORM 352
22200 - LOG_ID_AUTO_UPT_CERT 353
22201 - LOG_ID_AUTO_GEN_CERT 354
22203 - LOG_ID_AUTO_GEN_CERT_FAIL 355
22204 - LOG_ID_AUTO_GEN_CERT_PENDING 355
22205 - LOG_ID_AUTO_GEN_CERT_SUCC 356
22206 - LOG_ID_CRL_EXPIRED 357
22700 - LOG_ID_IPS_FAIL_OPEN 358
22701 - LOG_ID_IPS_FAIL_OPEN_END 358
22800 - LOG_ID_SCAN_SERV_FAIL 359
22802 - LOG_ID_ENTER_FD_CONSERVE_MODE 360
22803 - LOG_ID_LEAVE_FD_CONSERVE_MODE 361
22804 - LOG_ID_LIC_STATUS_CHG 361
22805 - LOG_ID_FAIL_TO_VALIDATE_LIC 362
22806 - LOG_ID_DUP_LIC 363
22808 - LOG_ID_LIC_EXPIRE 364

FortiOS 6.0.10 Log Reference 9

Fortinet, Inc.
22809 - LOG_ID_LIC_WILL_EXPIRE 364
22891 - LOG_ID_FLCFGD_SYNC_ERROR 365
22892 - LOG_ID_FLCFGD_SYNC_COMPLETE 366
22893 - LOG_ID_FLCFGD_SYNC_STATE 366
22894 - LOG_ID_FLCFGD_UPGRADE_ERROR 367
22895 - LOG_ID_FLCFGD_UPGRADE_STATUS 368
22900 - LOG_ID_CAPUTP_SESSION 369
22901 - LOG_ID_FAZ_CON 369
22902 - LOG_ID_FAZ_DISCON 370
22903 - LOG_ID_FAZ_CON_ERR 371
22904 - LOG_ID_CAPUTP_SESSION_NOTIF 372
22912 - LOG_ID_FDS_SRV_ERRCON 372
22913 - LOG_ID_FDS_SRV_DISCON 373
22914 - LOG_ID_FDS_SRV_CHG 374
22915 - LOG_ID_FDS_SRV_CON 374
22916 - LOG_ID_FDS_STATUS 375
22917 - LOG_ID_FDS_SMS_QUOTA 376
22918 - LOG_ID_FDS_CTRL_STATUS 377
22921 - LOG_ID_EVENT_ROUTE_INFO_CHANGED 377
22922 - LOG_ID_EVENT_LINK_MONITOR_STATUS 378
22923 - LOG_ID_EVENT_VWL_LQTY_STATUS 379
22924 - LOG_ID_EVENT_VWL_VOLUME_STATUS 379
22949 - LOG_ID_FDS_JOIN 380
22950 - LOG_ID_FDS_LOGIN_SUCC 381
22951 - LOG_ID_FDS_LOGOUT 382
22952 - LOG_ID_FDS_LOGIN_FAIL 382
22953 - LOG_ID_IOC_DETECTED 383
23101 - LOG_ID_IPSEC_TUNNEL_UP 384
23102 - LOG_ID_IPSEC_TUNNEL_DOWN 384
23103 - LOG_ID_IPSEC_TUNNEL_STAT 385
26001 - LOG_ID_DHCP_ACK 386
26002 - LOG_ID_DHCP_RELEASE 387
26003 - LOG_ID_DHCP_STAT 388
26004 - LOG_ID_DHCP_CLIENT_LEASE 389
26005 - LOG_ID_DHCP_LEASE_USAGE_HIGH 389
26006 - LOG_ID_DHCP_LEASE_USAGE_FULL 390
26007 - LOG_ID_DHCP_BLOCKED_MAC 391
26008 - LOG_ID_DHCP_DDNS_ADD 391
26009 - LOG_ID_DHCP_DDNS_DELETE 392
26010 - LOG_ID_DHCP_DDNS_COMPLETED 393
26011 - LOG_ID_DHCPV6_REPLY 394
26012 - LOG_ID_DHCPV6_RELEASE 394
27001 - LOG_ID_VRRP_STATE_CHG 395
29001 - LOG_ID_PPPD_MSG 396
29002 - LOG_ID_PPPD_AUTH_SUC 397
29003 - LOG_ID_PPPD_AUTH_FAIL 398
29010 - LOG_ID_PPPOE_STATUS_REPORT_NOTIF 398
29011 - LOG_ID_PPPD_FAIL_TO_EXEC 399
29012 - LOG_ID_PPP_OPT_ERR 400

FortiOS 6.0.10 Log Reference 10

Fortinet, Inc.
29013 - LOG_ID_PPPD_START 400
29014 - LOG_ID_PPPD_EXIT 401
29015 - LOG_ID_PPP_RCV_BAD_PEER_IP 402
29016 - LOG_ID_PPP_RCV_BAD_LOCAL_IP 402
29017 - LOG_ID_PPP_OPT_NOTIF 403
29021 - LOG_ID_EVENT_AUTH_SNMP_QUERY_FAILED 404
29022 - LOG_ID_DDNS_UPDATE_FAIL 404
32001 - LOG_ID_ADMIN_LOGIN_SUCC 405
32002 - LOG_ID_ADMIN_LOGIN_FAIL 406
32003 - LOG_ID_ADMIN_LOGOUT 407
32005 - LOG_ID_ADMIN_OVERIDE_VDOM 408
32006 - LOG_ID_ADMIN_ENTER_VDOM 409
32007 - LOG_ID_ADMIN_LEFT_VDOM 410
32008 - LOG_ID_VIEW_DISK_LOG_FAIL 410
32009 - LOG_ID_SYSTEM_START 411
32010 - LOG_ID_DISK_LOG_FULL 412
32011 - LOG_ID_LOG_ROLL 412
32014 - LOG_ID_CS_LIC_EXPIRE 413
32015 - LOG_ID_DISK_LOG_USAGE 414
32016 - LOG_ID_FDS_QUOTA_WARN 414
32017 - LOG_ID_FDS_DAILY_QUOTA_FULL 415
32018 - LOG_ID_FIPS_ENTER_ERR_MOD 416
32019 - LOG_ID_CC_ENTER_ERR_MOD 416
32020 - LOG_ID_SSH_CORRPUT_MAC 417
32021 - LOG_ID_ADMIN_LOGIN_DISABLE 418
32022 - LOG_ID_VDOM_ENABLED 419
32023 - LOG_ID_MEM_LOG_FIRST_FULL 419
32024 - LOG_ID_ADMIN_PASSWD_EXPIRE 420
32025 - LOG_ID_SSH_REKEY 421
32026 - LOG_ID_SSH_BAD_PACKET_LENGTH 421
32027 - LOG_ID_VIEW_DISK_LOG_SUCC 422
32028 - LOG_ID_LOG_DEL_DIR 423
32029 - LOG_ID_LOG_DEL_FILE 423
32030 - LOG_ID_SEND_FDS_STAT 424
32031 - LOG_ID_VIEW_MEM_LOG_FAIL 425
32032 - LOG_ID_DISK_DLP_ARCH_FULL 426
32033 - LOG_ID_DISK_QUAR_FULL 426
32034 - LOG_ID_DISK_REPORT_FULL 427
32035 - LOG_ID_VDOM_DISABLED 427
32036 - LOG_ID_DISK_IPS_ARCH_FULL 428
32037 - LOG_ID_DISK_LOG_FIRST_FULL 429
32038 - LOG_ID_LOG_ROLL_FORTICRON 429
32039 - LOG_ID_VIEW_MEM_LOG_SUCC 430
32040 - LOG_ID_REPORT_DELETED 431
32041 - LOG_ID_REPORT_DELETED_GUI 432
32042 - LOG_ID_MEM_LOG_SECOND_FULL 432
32043 - LOG_ID_MEM_LOG_FINAL_FULL 433
32044 - LOG_ID_LOG_DELETE 434
32045 - LOG_ID_MGR_LIC_EXPIRE 434

FortiOS 6.0.10 Log Reference 11

Fortinet, Inc.
32046 - LOG_ID_SSL_CORRPUT_MAC 435
32048 - LOG_ID_SCHEDULE_EXPIRE 436
32049 - LOG_ID_FC_EXPIRE 436
32050 - LOG_ID_POL_PKT_CAPTURE_FULL 437
32051 - LOG_ID_LOG_UPLOAD 438
32052 - LOG_ID_UPLOAD_RUN_SCRIPT 438
32053 - LOG_ID_ADMIN_MTNER_LOGIN_SUCC 439
32054 - LOG_ID_ADMIN_MTNER_LOGOUT 440
32055 - LOG_ID_FDS_QUOTA_WARN_WARNING 441
32056 - LOG_ID_FDS_QUOTA_WARN_INFO 442
32057 - LOG_ID_VIEW_FAZ_LOG_FAIL 442
32058 - LOG_ID_VIEW_FAZ_LOG_SUCC 443
32095 - LOG_ID_GUI_CHG_SUB_MODULE 444
32097 - LOG_ID_DELETE_CAPTURE_PKT 445
32100 - LOG_ID_FORTI_TOKEN_SYNC 445
32102 - LOG_ID_CHG_CONFIG 446
32103 - LOG_ID_NEW_FIRMWARE 447
32104 - LOG_ID_CHG_CONFIG_GUI 448
32105 - LOG_ID_NTP_SVR_STAUS_CHG_REACHABLE 448
32106 - LOG_ID_NTP_SVR_STAUS_CHG_RESOLVABLE 449
32107 - LOG_ID_NTP_SVR_STAUS_CHG_UNRESOLVABLE 450
32108 - LOG_ID_NTP_SVR_STAUS_CHG_UNREACHABLE 451
32109 - LOG_ID_UPD_SIGN_AV_DB 451
32110 - LOG_ID_UPD_SIGN_IPS_DB 452
32111 - LOG_ID_UPD_SIGN_AVIPS_DB 453
32113 - LOG_ID_UPD_SIGN_SRCVIS_DB 454
32114 - LOG_ID_UPD_SIGN_GEOIP_DB 454
32116 - LOG_ID_UPD_SIGN_AVPKG_FAILURE 455
32117 - LOG_ID_UPD_SIGN_AVPKG_SUCCESS 456
32118 - LOG_ID_UPD_ADMIN_AV_DB 457
32119 - LOG_ID_UPD_SCANUNIT_AV_DB 457
32120 - LOG_ID_RPT_ADD_DATASET 458
32122 - LOG_ID_RPT_DEL_DATASET 459
32125 - LOG_ID_RPT_ADD_CHART 459
32126 - LOG_ID_RPT_DEL_CHART 460
32129 - LOG_ID_ADD_GUEST 461
32130 - LOG_ID_CHG_USER 462
32131 - LOG_ID_DEL_GUEST 463
32132 - LOG_ID_ADD_USER 463
32138 - LOG_ID_REBOOT 464
32140 - LOG_ID_TIME_USER_SETTING_CHG 465
32141 - LOG_ID_TIME_NTP_SETTING_CHG 466
32142 - LOG_ID_BACKUP_CONF 467
32143 - LOG_ID_BACKUP_CONF_BY_SCP 467
32144 - LOG_ID_BACKUP_CONF_ERROR 468
32145 - LOG_ID_BACKUP_CONF_ALERT 469
32148 - LOG_ID_GET_CRL 470
32149 - LOG_ID_COMMAND_FAIL 470
32151 - LOG_ID_ADD_IP6_LOCAL_POL 471

FortiOS 6.0.10 Log Reference 12

Fortinet, Inc.
32152 - LOG_ID_CHG_IP6_LOCAL_POL 472
32153 - LOG_ID_DEL_IP6_LOCAL_POL 473
32155 - LOG_ID_ACT_FTOKEN_REQ 473
32156 - LOG_ID_ACT_FTOKEN_SUCC 474
32157 - LOG_ID_SYNC_FTOKEN_SUCC 475
32158 - LOG_ID_SYNC_FTOKEN_FAIL 476
32159 - LOG_ID_ACT_FTOKEN_FAIL 476
32160 - LOG_ID_FTM_PUSH_SUCC 477
32161 - LOG_ID_FTM_PUSH_FAIL 478
32168 - LOG_ID_REACH_VDOM_LIMIT 479
32169 - LOG_ID_ALARM_DLP_DB 479
32170 - LOG_ID_ALARM_MSG 480
32171 - LOG_ID_ALARM_ACK 481
32172 - LOG_ID_ADD_IP4_LOCAL_POL 482
32173 - LOG_ID_CHG_IP4_LOCAL_POL 482
32174 - LOG_ID_DEL_IP4_LOCAL_POL 483
32190 - LOG_ID_UPT_INVALID_IMG 484
32191 - LOG_ID_UPT_INVALID_IMG_CC 485
32192 - LOG_ID_UPT_INVALID_IMG_RSA 485
32193 - LOG_ID_UPT_IMG_RSA 486
32194 - LOG_ID_UPT_IMG_FAIL 487
32199 - LOG_ID_RESTORE_IMG_USB 488
32200 - LOG_ID_SHUTDOWN 488
32201 - LOG_ID_LOAD_IMG_SUCC 489
32202 - LOG_ID_RESTORE_IMG 490
32203 - LOG_ID_RESTORE_CONF 491
32204 - LOG_ID_RESTORE_FGD_SVR 491
32205 - LOG_ID_RESTORE_VDOM_LIC 492
32206 - LOG_ID_RESTORE_SCRIPT 493
32207 - LOG_ID_RETRIEVE_CONF_LIST 494
32208 - LOG_ID_IMP_PKCS12_CERT 494
32209 - LOG_ID_RESTORE_USR_DEF_IPS 495
32210 - LOG_ID_BACKUP_IMG_SUCC 496
32211 - LOG_ID_UPLOAD_REVISION 497
32212 - LOG_ID_DEL_REVISION 497
32213 - LOG_ID_RESTORE_TEMPLATE 498
32214 - LOG_ID_RESTORE_FILE 499
32215 - LOG_ID_UPT_IMG 500
32217 - LOG_ID_UPD_IPS 500
32218 - LOG_ID_UPD_DLP 501
32219 - LOG_ID_BACKUP_OUTPUT 502
32220 - LOG_ID_BACKUP_COMMAND 503
32221 - LOG_ID_UPD_VDOM_LIC 503
32222 - LOG_ID_GLB_SETTING_CHG 504
32223 - LOG_ID_BACKUP_USER_DEF_IPS 505
32224 - LOG_ID_BACKUP_DISK_LOG 506
32225 - LOG_ID_DEL_ALL_REVISION 507
32226 - LOG_ID_LOAD_IMG_FAIL 507
32227 - LOG_ID_UPD_DLP_FAIL 508

FortiOS 6.0.10 Log Reference 13

Fortinet, Inc.
32228 - LOG_ID_LOAD_IMG_FAIL_WRONG_IMG 509
32229 - LOG_ID_LOAD_IMG_FAIL_NO_RSA 510
32230 - LOG_ID_LOAD_IMG_FAIL_INVALID_RSA 510
32231 - LOG_ID_RESTORE_FGD_SVR_FAIL 511
32232 - LOG_ID_RESTORE_VDOM_LIC_FAIL 512
32233 - LOG_ID_BACKUP_IMG_FAIL 512
32234 - LOG_ID_RESTORE_IMG_INVALID_CC 513
32235 - LOG_ID_RESTORE_IMG_FORTIGUARD 514
32236 - LOG_ID_BACKUP_MEM_LOG 515
32237 - LOG_ID_BACKUP_MEM_LOG_FAIL 515
32238 - LOG_ID_BACKUP_DISK_LOG_FAIL 516
32239 - LOG_ID_BACKUP_DISK_LOG_USB 517
32240 - LOG_ID_SYS_USB_MODE 518
32241 - LOG_ID_BACKUP_DISK_LOG_USB_FAIL 518
32242 - LOG_ID_UPD_VDOM_LIC_FAIL 519
32243 - LOG_ID_UPD_IPS_SCP 520
32244 - LOG_ID_UPD_IPS_SCP_FAIL 521
32245 - LOG_ID_BACKUP_USER_DEF_IPS_FAIL 521
32246 - LOG_ID_RESTORE_USR_DEF_IPS_CRITICAL 522
32247 - LOG_ID_SSH_NEGOTIATION_FAILURE 523
32252 - LOG_ID_FACTORY_RESET 524
32253 - LOG_ID_FORMAT_RAID 524
32254 - LOG_ID_ENABLE_RAID 525
32255 - LOG_ID_DISABLE_RAID 526
32300 - LOG_ID_UPLOAD_RPT_IMG 527
32301 - LOG_ID_ADD_VDOM 528
32302 - LOG_ID_DEL_VDOM 528
32545 - LOG_ID_SYS_RESTART 529
32546 - LOG_ID_APPLICATION_CRASH 530
32547 - LOG_ID_AUTOSCRIPT_START 530
32548 - LOG_ID_AUTOSCRIPT_STOP 531
32549 - LOG_ID_AUTOSCRIPT_STOP_AUTO 532
32550 - LOG_ID_AUTOSCRIPT_DELETE_RSLT 533
32551 - LOG_ID_AUTOSCRIPT_BACKUP_RSLT 533
32552 - LOG_ID_AUTOSCRIPT_CHECK_STATUS 534
32553 - LOG_ID_AUTOSCRIPT_STOP_REACH_LIMIT 535
32561 - LOG_ID_ADMIN_LOGOUT_DISCONNECT 535
32562 - LOG_ID_STORE_CONF_FAIL_SPACE 536
32564 - LOG_ID_RESTORE_CONF_FAIL 537
32565 - LOG_ID_RESTORE_CONF_BY_MGMT 538
32566 - LOG_ID_RESTORE_CONF_BY_SCP 539
32567 - LOG_ID_RESTORE_CONF_BY_USB 539
32568 - LOG_ID_DEL_REVISION_DB 540
32569 - LOG_ID_FSW_SWITCH_LOG_EVENT 541
32570 - LOG_ID_ADMIN_MTNER_LOGOUT_DISCONNECT 542
32601 - LOG_ID_FGT_SWITCH_LOG_DISCOVER 543
32602 - LOG_ID_FGT_SWITCH_LOG_AUTH 543
32603 - LOG_ID_FGT_SWITCH_LOG_DEAUTH 544
32604 - LOG_ID_FGT_SWITCH_LOG_DELETE 545

FortiOS 6.0.10 Log Reference 14

Fortinet, Inc.
32605 - LOG_ID_FGT_SWITCH_LOG_TUNNEL_UP 545
32606 - LOG_ID_FGT_SWITCH_LOG_TUNNEL_DOWN 546
32607 - LOG_ID_FGT_SWITCH_PUSH_IMAGE 547
32608 - LOG_ID_FGT_SWITCH_STAGE_IMAGE 548
32609 - LOG_ID_FGT_SWITCH_DISABLE_DISCOVERY 548
32610 - LOG_ID_FGT_SWITCH_LOG_WARNING 549
32693 - LOG_ID_FGT_SWITCH_GROUP_SWC 550
32694 - LOG_ID_FGT_SWITCH_GROUP_POE 551
32695 - LOG_ID_FGT_SWITCH_GROUP_LINK 551
32696 - LOG_ID_FGT_SWITCH_GROUP_STP 552
32697 - LOG_ID_FGT_SWITCH_GROUP_SWITCH 553
32698 - LOG_ID_FGT_SWITCH_GROUP_ROUTER 554
32699 - LOG_ID_FGT_SWITCH_GROUP_SYSTEM 555
35001 - LOG_ID_HA_SYNC_VIRDB 556
35002 - LOG_ID_HA_SYNC_ETDB 556
35003 - LOG_ID_HA_SYNC_EXDB 557
35004 - LOG_ID_HA_SYNC_FLDB 558
35005 - LOG_ID_HA_SYNC_IPS 558
35007 - LOG_ID_HA_SYNC_AV 559
35009 - LOG_ID_HA_SYNC_CID 560
35010 - LOG_ID_HA_SYNC_UWDB 560
35011 - LOG_ID_HA_SYNC_FAIL 561
35012 - LOG_ID_CONF_SYNC_FAIL 561
36880 - LOG_ID_EVENT_SYSTEM_MAC_HOST_STORE_LIMIT 562
36881 - LOG_ID_EVENT_SYSTEM_CFG_REVERT 563
36882 - LOG_ID_EVENT_SYSTEM_CFG_MANUALLY_SAVED 563
37120 - MESGID_NEG_GENERIC_P1_NOTIF 564
37121 - MESGID_NEG_GENERIC_P1_ERROR 565
37122 - MESGID_NEG_GENERIC_P2_NOTIF 566
37123 - MESGID_NEG_GENERIC_P2_ERROR 568
37124 - MESGID_NEG_I_P1_ERROR 569
37125 - MESGID_NEG_I_P2_ERROR 570
37126 - MESGID_NEG_NO_STATE_ERROR 571
37127 - MESGID_NEG_PROGRESS_P1_NOTIF 572
37128 - MESGID_NEG_PROGRESS_P1_ERROR 574
37129 - MESGID_NEG_PROGRESS_P2_NOTIF 575
37130 - MESGID_NEG_PROGRESS_P2_ERROR 576
37131 - MESGID_ESP_ERROR 578
37132 - MESGID_ESP_CRITICAL 579
37133 - MESGID_INSTALL_SA 580
37134 - MESGID_DELETE_P1_SA 581
37135 - MESGID_DELETE_P2_SA 582
37136 - MESGID_DPD_FAILURE 584
37137 - MESGID_CONN_FAILURE 585
37138 - MESGID_CONN_UPDOWN 586
37139 - MESGID_P2_UPDOWN 587
37141 - MESGID_CONN_STATS 588
37889 - MESGID_VC_DELETE 590
37890 - MESGID_VC_MOVE_VDOM 590

FortiOS 6.0.10 Log Reference 15

Fortinet, Inc.
37891 - MESGID_VC_ADD_VDOM 591
37892 - MESGID_VC_MOVE_MEMB_STATE 592
37893 - MESGID_VC_DETECT_MEMB_DEAD 592
37894 - MESGID_VC_DETECT_MEMB_JOIN 593
37895 - MESGID_VC_ADD_HADEV 594
37896 - MESGID_VC_DEL_HADEV 595
37897 - MESGID_HADEV_READY 595
37898 - MESGID_HADEV_FAIL 596
37899 - MESGID_HADEV_PEERINFO 597
37900 - MESGID_HBDEV_DELETE 597
37901 - MESGID_HBDEV_DOWN 598
37902 - MESGID_HBDEV_UP 599
37903 - MESGID_SYNC_STATUS 600
37904 - MESGID_HA_ACTIVITY 600
37907 - MESGID_VLAN_HB_UP 601
37908 - MESGID_VLAN_HB_DOWN 602
37909 - MESGID_VLAN_HB_DOWN_SUM 602
38010 - LOG_ID_FIPS_ENCRY_FAIL 603
38011 - LOG_ID_FIPS_DECRY_FAIL 604
38012 - LOG_ID_ENTROPY_TOKEN 605
38031 - LOG_ID_FSSO_LOGON 605
38032 - LOG_ID_FSSO_LOGOFF 606
38033 - LOG_ID_FSSO_SVR_STATUS 607
38400 - LOGID_EVENT_NOTIF_SEND_SUCC 608
38401 - LOGID_EVENT_NOTIF_SEND_FAIL 609
38402 - LOGID_EVENT_NOTIF_DNS_FAIL 610
38403 - LOGID_EVENT_NOTIF_INSUFFICIENT_RESOURCE 611
38404 - LOGID_EVENT_NOTIF_HOSTNAME_ERROR 612
38405 - LOGID_NOTIF_CODE_SENDTO_SMS_PHONE 612
38406 - LOGID_NOTIF_CODE_SENDTO_SMS_TO 613
38407 - LOGID_NOTIF_CODE_SENDTO_EMAIL 614
38408 - LOGID_EVENT_OFTP_SSL_CONNECTED 614
38409 - LOGID_EVENT_OFTP_SSL_DISCONNECTED 615
38410 - LOGID_EVENT_OFTP_SSL_FAILED 616
38411 - LOGID_EVENT_TWO_F_AUTH_CODE_SENDTO 617
38412 - LOGID_EVENT_TOKEN_CODE_SENDTO 617
38420 - LOGID_EVENT_HTTPS_CONNECTION 618
38656 - LOGID_EVENT_RAD_RPT_PROTO_ERROR 619
38657 - LOGID_EVENT_RAD_RPT_PROF_NOT_FOUND 620
38658 - LOGID_EVENT_RAD_RPT_CTX_NOT_FOUND 620
38659 - LOGID_EVENT_RAD_RPT_ACCT_STOP_MISSED 621
38660 - LOGID_EVENT_RAD_RPT_ACCT_EVENT 622
38661 - LOGID_EVENT_RAD_RPT_OTHER 622
38662 - LOGID_EVENT_RAD_STAT_PROTO_ERROR 623
38663 - LOGID_EVENT_RAD_STAT_PROF_NOT_FOUND 624
38665 - LOGID_EVENT_RAD_STAT_ACCT_STOP_MISSED 625
38666 - LOGID_EVENT_RAD_STAT_ACCT_EVENT 626
38667 - LOGID_EVENT_RAD_STAT_OTHER 626
38668 - LOGID_EVENT_RAD_STAT_EP_BLK 627

FortiOS 6.0.10 Log Reference 16

Fortinet, Inc.
39424 - LOG_ID_EVENT_SSL_VPN_USER_TUNNEL_UP 628
39425 - LOG_ID_EVENT_SSL_VPN_USER_TUNNEL_DOWN 629
39426 - LOG_ID_EVENT_SSL_VPN_USER_SSL_LOGIN_FAIL 630
39936 - LOG_ID_EVENT_SSL_VPN_SESSION_WEB_TUNNEL_STATS 631
39937 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_DENY 632
39938 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_PASS 633
39939 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_TIMEOUT 634
39940 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_CLOSE 635
39941 - LOG_ID_EVENT_SSL_VPN_SESSION_SYS_BUSY 636
39942 - LOG_ID_EVENT_SSL_VPN_SESSION_CERT_OK 637
39943 - LOG_ID_EVENT_SSL_VPN_SESSION_NEW_CON 638
39944 - LOG_ID_EVENT_SSL_VPN_SESSION_ALERT 639
39945 - LOG_ID_EVENT_SSL_VPN_SESSION_EXIT_FAIL 639
39946 - LOG_ID_EVENT_SSL_VPN_SESSION_EXIT_ERR 640
39947 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_UP 641
39948 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_DOWN 642
39949 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_STATS 643
39950 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_UNKNOWNTAG 644
39951 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_ERROR 645
39952 - LOG_ID_EVENT_SSL_VPN_SESSION_ENTER_CONSERVE_MODE 646
39953 - LOG_ID_EVENT_SSL_VPN_SESSION_LEAVE_CONSERVE_MODE 647
40001 - LOG_ID_PPTP_TUNNEL_UP 648
40002 - LOG_ID_PPTP_TUNNEL_DOWN 649
40003 - LOG_ID_PPTP_TUNNEL_STAT 650
40014 - LOG_ID_PPTP_REACH_MAX_CON 651
40017 - LOG_ID_L2TPD_CLIENT_CON_FAIL 651
40019 - LOG_ID_L2TPD_CLIENT_DISCON 652
40021 - LOG_ID_PPTP_NOT_CONIG 653
40022 - LOG_ID_PPTP_NO_IP_AVAIL 654
40024 - LOG_ID_PPTP_OUT_MEM 654
40034 - LOG_ID_PPTP_START 655
40035 - LOG_ID_PPTP_START_FAIL 656
40036 - LOG_ID_PPTP_EXIT 656
40037 - LOG_ID_PPTPD_SVR_DISCON 657
40038 - LOG_ID_PPTPD_CLIENT_CON 658
40039 - LOG_ID_PPTPD_CLIENT_DISCON 659
40101 - LOG_ID_L2TP_TUNNEL_UP 659
40102 - LOG_ID_L2TP_TUNNEL_DOWN 660
40103 - LOG_ID_L2TP_TUNNEL_STAT 661
40114 - LOG_ID_L2TPD_START 662
40115 - LOG_ID_L2TPD_EXIT 663
40118 - LOG_ID_L2TPD_CLIENT_CON 663
40704 - LOG_ID_EVENT_SYS_PERF 664
40705 - LOG_ID_EVENT_SYS_CPU_USAGE 665
40960 - LOGID_EVENT_WAD_WEBPROXY_FWD_SRV_ERROR 666
41000 - LOG_ID_UPD_FGT_SUCC 667
41001 - LOG_ID_UPD_FGT_FAIL 667
41002 - LOG_ID_UPD_SRC_VIS 668
41006 - LOG_ID_UPD_FSA_VIRDB 669

FortiOS 6.0.10 Log Reference 17

Fortinet, Inc.
41984 - LOG_ID_EVENT_VPN_CERT_LOAD 669
41985 - LOG_ID_EVENT_VPN_CERT_REMOVAL 670
41986 - LOG_ID_EVENT_VPN_CERT_REGEN 671
41987 - LOG_ID_EVENT_VPN_CERT_UPDATE 672
41988 - LOG_ID_EVENT_SSL_VPN_SETTING_UPDATE 673
41989 - LOG_ID_EVENT_VPN_CERT_ERR 674
41990 - LOG_ID_EVENT_VPN_CERT_UPDATE_FAILED 674
41991 - LOG_ID_EVENT_VPN_CERT_EXPORT 675
42201 - LOG_ID_NETX_VMX_ATTACH 676
42202 - LOG_ID_NETX_VMX_DETACH 677
42203 - LOG_ID_NETX_VMX_DENIED 677
43008 - LOG_ID_EVENT_AUTH_SUCCESS 678
43009 - LOG_ID_EVENT_AUTH_FAILED 679
43010 - LOG_ID_EVENT_AUTH_LOCKOUT 680
43011 - LOG_ID_EVENT_AUTH_TIME_OUT 681
43014 - LOG_ID_EVENT_AUTH_FSAE_LOGON 682
43015 - LOG_ID_EVENT_AUTH_FSAE_LOGOFF 683
43016 - LOG_ID_EVENT_AUTH_NTLM_AUTH_SUCCESS 684
43017 - LOG_ID_EVENT_AUTH_NTLM_AUTH_FAIL 684
43018 - LOG_ID_EVENT_AUTH_FGOVRD_FAIL 685
43020 - LOG_ID_EVENT_AUTH_FGOVRD_SUCCESS 686
43025 - LOG_ID_EVENT_AUTH_PROXY_SUCCESS 687
43026 - LOG_ID_EVENT_AUTH_PROXY_FAILED 688
43027 - LOG_ID_EVENT_AUTH_PROXY_TIME_OUT 689
43028 - LOG_ID_EVENT_AUTH_PROXY_GROUP_INFO_FAILED 690
43029 - LOG_ID_EVENT_AUTH_WARNING_SUCCESS 691
43030 - LOG_ID_EVENT_AUTH_WARNING_TBL_FULL 692
43032 - LOG_ID_EVENT_AUTH_PROXY_USER_LIMIT_REACHED 693
43033 - LOG_ID_EVENT_AUTH_PROXY_MULTIPLE_LOGIN 694
43034 - LOG_ID_EVENT_AUTH_PROXY_NO_RESP 695
43037 - LOG_ID_EVENT_AUTH_IPV4_FLUSH 696
43038 - LOG_ID_EVENT_AUTH_IPV6_FLUSH 696
43039 - LOG_ID_EVENT_AUTH_LOGON 697
43040 - LOG_ID_EVENT_AUTH_LOGOUT 698
43041 - LOG_ID_EVENT_AUTH_DISCLAIMER_ACCEPT 699
43042 - LOG_ID_EVENT_AUTH_DISCLAIMER_DECLINE 700
43043 - LOG_ID_EVENT_AUTH_EMAIL_COLLECTING_SUCCESS 701
43044 - LOG_ID_EVENT_AUTH_EMAIL_COLLECTING_FAIL 702
43045 - LOG_ID_EVENT_AUTH_8021X_SUCCESS 703
43046 - LOG_ID_EVENT_AUTH_8021X_FAIL 703
43050 - LOG_ID_EVENT_AUTH_FSAE_CONNECT 704
43051 - LOG_ID_EVENT_AUTH_FSAE_DISCONNECT 705
43264 - LOGID_MMS_STATS 706
43520 - LOG_ID_EVENT_WIRELESS_SYS 707
43521 - LOG_ID_EVENT_WIRELESS_ROGUE 707
43522 - LOG_ID_EVENT_WIRELESS_WTP 709
43524 - LOG_ID_EVENT_WIRELESS_STA 710
43525 - LOG_ID_EVENT_WIRELESS_ONWIRE 711
43526 - LOG_ID_EVENT_WIRELESS_WTPR 712

FortiOS 6.0.10 Log Reference 18

Fortinet, Inc.
43527 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG 713
43528 - LOG_ID_EVENT_WIRELESS_WTPR_ERROR 714
43529 - LOG_ID_EVENT_WIRELESS_CLB 715
43530 - LOG_ID_EVENT_WIRELESS_WIDS_WL_BRIDGE 716
43531 - LOG_ID_EVENT_WIRELESS_WIDS_BR_DEAUTH 717
43532 - LOG_ID_EVENT_WIRELESS_WIDS_NL_PBRESP 718
43533 - LOG_ID_EVENT_WIRELESS_WIDS_MAC_OUI 719
43534 - LOG_ID_EVENT_WIRELESS_WIDS_LONG_DUR 721
43535 - LOG_ID_EVENT_WIRELESS_WIDS_WEP_IV 722
43542 - LOG_ID_EVENT_WIRELESS_WIDS_EAPOL_FLOOD 723
43544 - LOG_ID_EVENT_WIRELESS_WIDS_MGMT_FLOOD 724
43546 - LOG_ID_EVENT_WIRELESS_WIDS_SPOOF_DEAUTH 725
43548 - LOG_ID_EVENT_WIRELESS_WIDS_ASLEAP 726
43550 - LOG_ID_EVENT_WIRELESS_STA_LOCATE 727
43551 - LOG_ID_EVENT_WIRELESS_WTP_JOIN 728
43552 - LOG_ID_EVENT_WIRELESS_WTP_LEAVE 729
43553 - LOG_ID_EVENT_WIRELESS_WTP_FAIL 730
43554 - LOG_ID_EVENT_WIRELESS_WTP_UPDATE 731
43555 - LOG_ID_EVENT_WIRELESS_WTP_RESET 732
43556 - LOG_ID_EVENT_WIRELESS_WTP_KICK 733
43557 - LOG_ID_EVENT_WIRELESS_WTP_ADD_FAILURE 734
43558 - LOG_ID_EVENT_WIRELESS_WTP_CFG_ERR 735
43559 - LOG_ID_EVENT_WIRELESS_WTP_SN_MISMATCH 736
43560 - LOG_ID_EVENT_WIRELESS_SYS_AC_RESTARTED 737
43561 - LOG_ID_EVENT_WIRELESS_SYS_AC_HOSTAPD_UP 737
43562 - LOG_ID_EVENT_WIRELESS_SYS_AC_HOSTAPD_DOWN 738
43563 - LOG_ID_EVENT_WIRELESS_ROGUE_DETECT 739
43564 - LOG_ID_EVENT_WIRELESS_ROGUE_OFFAIR 740
43565 - LOG_ID_EVENT_WIRELESS_ROGUE_ONAIR 741
43566 - LOG_ID_EVENT_WIRELESS_ROGUE_OFFWIRE 743
43567 - LOG_ID_EVENT_WIRELESS_FAKEAP_DETECT 744
43568 - LOG_ID_EVENT_WIRELESS_FAKEAP_ONAIR 746
43569 - LOG_ID_EVENT_WIRELESS_ROGUE_SUPPRESSED 747
43570 - LOG_ID_EVENT_WIRELESS_ROGUE_UNSUPPRESSED 749
43571 - LOG_ID_EVENT_WIRELESS_ROGUE_DETECT_CHG 750
43572 - LOG_ID_EVENT_WIRELESS_STA_ASSO 752
43573 - LOG_ID_EVENT_WIRELESS_STA_AUTH 753
43574 - LOG_ID_EVENT_WIRELESS_STA_DASS 754
43575 - LOG_ID_EVENT_WIRELESS_STA_DAUT 755
43576 - LOG_ID_EVENT_WIRELESS_STA_IDLE 756
43577 - LOG_ID_EVENT_WIRELESS_STA_DENY 757
43578 - LOG_ID_EVENT_WIRELESS_STA_KICK 759
43579 - LOG_ID_EVENT_WIRELESS_STA_IP 760
43580 - LOG_ID_EVENT_WIRELESS_STA_LEAVE_WTP 761
43581 - LOG_ID_EVENT_WIRELESS_STA_WTP_DISCONN 762
43582 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_UNCLASSIFIED 763
43583 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_ACCEPTED 764
43584 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_ROGUE 765
43585 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_SUPPRESSED 766

FortiOS 6.0.10 Log Reference 19

Fortinet, Inc.
43586 - LOG_ID_EVENT_WIRELESS_WTPR_DARRP_CHAN 766
43587 - LOG_ID_EVENT_WIRELESS_WTPR_DARRP_START 767
43588 - LOG_ID_EVENT_WIRELESS_WTPR_OPER_CHAN 768
43589 - LOG_ID_EVENT_WIRELESS_WTPR_RADAR 769
43590 - LOG_ID_EVENT_WIRELESS_WTPR_NOL 770
43591 - LOG_ID_EVENT_WIRELESS_WTPR_COUNTRY_CFG_SUCCESS 771
43592 - LOG_ID_EVENT_WIRELESS_WTPR_OPER_COUNTRY 772
43593 - LOG_ID_EVENT_WIRELESS_WTPR_CFG_TXPOWER 773
43594 - LOG_ID_EVENT_WIRELESS_WTPR_OPER_TXPOWER 774
43595 - LOG_ID_EVENT_WIRELESS_CLB_DENY 775
43596 - LOG_ID_EVENT_WIRELESS_CLB_RETRY 776
43597 - LOG_ID_EVENT_WIRELESS_WTP_ADD 777
43598 - LOG_ID_EVENT_WIRELESS_WTP_ADD_XSS 778
43599 - LOG_ID_EVENT_WIRELESS_WTP_DEL 779
43600 - LOG_ID_EVENT_WIRELESS_WTPR_DARRP_STOP 780
43601 - LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON 781
43602 - LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON_SUCCESS 782
43603 - LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON_FAILURE 783
43604 - LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_REQUEST 785
43605 - LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_SUCCESS 786
43606 - LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_FAILURE 787
43607 - LOG_ID_EVENT_WIRELESS_STA_CAP_DISCLAIMER_CHECK 788
43608 - LOG_ID_EVENT_WIRELESS_STA_CAP_DISCLAIMER_DECLINE 789
43609 - LOG_ID_EVENT_WIRELESS_SYS_AC_DARRP_START 790
43610 - LOG_ID_EVENT_WIRELESS_SYS_AC_DARRP_STOP 791
43611 - LOG_ID_EVENT_WIRELESS_SYS_AC_UP 792
43612 - LOG_ID_EVENT_WIRELESS_SYS_AC_CFG_LOADED 792
43613 - LOG_ID_EVENT_WIRELESS_WTP_ERR 793
43614 - LOG_ID_EVENT_WIRELESS_DHCP_STAVATION 794
43615 - LOG_ID_EVENT_WIRELESS_SYS_AC_IPSEC_FAIL 795
43616 - LOG_ID_EVENT_WIRELESS_WTPR_NOL_ADD 796
43617 - LOG_ID_EVENT_WIRELESS_WTPPROF_ADJUSTED 797
43618 - LOG_ID_EVENT_WIRELESS_WTP_IMAGE_RC_SUCCESS 798
43621 - LOG_ID_EVENT_WIRELESS_WTP_DATA_CHAN_CHG 798
43776 - LOG_ID_EVENT_NAC_QUARANTINE 799
43777 - LOG_ID_EVENT_NAC_ANOMALY_QUARANTINE 800
43800 - LOG_ID_EVENT_ELBC_BLADE_JOIN 802
43801 - LOG_ID_EVENT_ELBC_BLADE_LEAVE 802
43802 - LOG_ID_EVENT_ELBC_MASTER_BLADE_FOUND 803
43803 - LOG_ID_EVENT_ELBC_MASTER_BLADE_LOST 804
43804 - LOG_ID_EVENT_ELBC_MASTER_BLADE_CHANGE 805
43805 - LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_FOUND 806
43806 - LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_LOST 806
43807 - LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_CHANGE 807
43808 - LOG_ID_EVENT_ELBC_CHASSIS_ACTIVE 808
43809 - LOG_ID_EVENT_ELBC_CHASSIS_INACTIVE 809
44544 - LOGID_EVENT_CONFIG_PATH 810
44545 - LOGID_EVENT_CONFIG_OBJ 810
44546 - LOGID_EVENT_CONFIG_ATTR 811

FortiOS 6.0.10 Log Reference 20

Fortinet, Inc.
44547 - LOGID_EVENT_CONFIG_OBJATTR 812
44548 - LOGID_EVENT_CONFIG_EXEC 813
44549 - LOGID_EVENT_CONFIG_OBJATTR_MTNER 814
44550 - LOGID_EVENT_CONFIG_OBJ_MTNER 815
44551 - LOGID_EVENT_CONFIG_ATTR_MTNER 816
44552 - LOGID_EVENT_CONFIG_PATH_MTNER 816
44553 - LOGID_EVENT_CONFIG_FIXEDPORT_DIS 817
45057 - LOG_ID_FCC_ADD 818
45058 - LOG_ID_FCC_CLOSE 819
45061 - LOG_ID_FCC_CLOSE_BY_TYPE 819
45071 - LOG_ID_FCC_VULN_SCAN 820
45081 - LOG_ID_FCC_COMPL_CHANGE 821
45082 - LOG_ID_FCC_NOT_COMPL 822
45083 - LOG_ID_FCC_NOT_COMPL_DEBUG 823
45084 - LOG_ID_FCC_SIG_IDS_DETAILS 824
45100 - LOG_ID_EC_REG_FAIL_LIMIT 825
45101 - LOG_ID_EC_REG_SUCCEED 826
45102 - LOG_ID_EC_REG_RENEWED 827
45103 - LOG_ID_EC_REG_BLOCK 828
45104 - LOG_ID_EC_REG_UNBLOCK 828
45105 - LOG_ID_EC_REG_DEREG 829
45106 - LOG_ID_EC_REG_LIC_UPGRADED 830
45107 - LOG_ID_EC_CONF_DISTRIBUTED 830
45108 - LOG_ID_EC_FTCL_UNREG 831
45109 - LOG_ID_EC_FTCL_LOGOFF 832
45110 - LOG_ID_EC_FTCL_ENABLE_NOTSYNC 833
45111 - LOG_ID_EC_REG_SYNC_FAIL 834
45112 - LOG_ID_EC_REG_FAIL_KEY 835
45113 - LOG_ID_EC_REG_FAIL_BLOCKED 835
45114 - LOG_ID_EC_REG_QUARANTINE 836
45115 - LOG_ID_EC_REG_UNQUARANTINE 837
45116 - LOG_ID_EC_REG_UNQUARANTINE_ALL 838
45117 - LOG_ID_EC_REG_FAIL_VER 838
45118 - LOG_ID_EC_REG_FAIL_UNSUPPORTED 839
45151 - LOG_ID_EVENT_DSSCC_FAIL 840
45152 - LOG_ID_EVENT_DSSCC_PASS 841
45161 - LOG_ID_EVENT_DSSCC_EXEC 842
46000 - LOG_ID_VIP_REAL_SVR_ENA 842
46001 - LOG_ID_VIP_REAL_SVR_DISA 843
46002 - LOG_ID_VIP_REAL_SVR_UP 844
46003 - LOG_ID_VIP_REAL_SVR_DOWN 845
46004 - LOG_ID_VIP_REAL_SVR_ENT_HOLDDOWN 846
46005 - LOG_ID_VIP_REAL_SVR_FAIL_HOLDDOWN 846
46006 - LOG_ID_VIP_REAL_SVR_FAIL 847
46400 - LOG_ID_EVENT_EXT_SYS 848
46401 - LOG_ID_EVENT_EXT_LOCAL 849
46402 - LOG_ID_EVENT_EXT_REMOTE 850
46403 - LOG_ID_EVENT_EXT_LOCAL_ERROR 850
46501 - LOG_ID_INTERNAL_LTE_MODEM_DETECTION 851

FortiOS 6.0.10 Log Reference 21

Fortinet, Inc.
46502 - LOG_ID_INTERNAL_LTE_MODEM_GPSD 852
46503 - LOG_ID_INTERNAL_LTE_MODEM_GPS_LOC_ACQUISITION 852
46504 - LOG_ID_INTERNAL_LTE_MODEM_BILLD 853
46505 - LOG_ID_INTERNAL_LTE_MODEM_BILLING_PURGED 854
46506 - LOG_ID_INTERNAL_LTE_MODEM_BILLING_DAILY_LOG 854
46507 - LOG_ID_INTERNAL_LTE_MODEM_FW_UPGRADE 855
46508 - LOG_ID_INTERNAL_LTE_MODEM_QDL_DETECTION 855
46509 - LOG_ID_INTERNAL_LTE_MODEM_REBOOT 856
46510 - LOG_ID_INTERNAL_LTE_MODEM_OP_MODE 857
46511 - LOG_ID_INTERNAL_LTE_MODEM_POWER_ON_OFF 857
46512 - LOG_ID_INTERNAL_LTE_MODEM_SIM_STATE 858
46513 - LOG_ID_INTERNAL_LTE_MODEM_LINK_CONNECTION 859
46514 - LOG_ID_INTERNAL_LTE_MODEM_MANUAL_HANDOVER 859
46515 - LOG_ID_INTERNAL_LTE_MODEM_IP_ADDR 860
46600 - LOG_ID_EVENT_AUTOMATION_TRIGGERED 861
46900 - LOG_ID_POE_STATUS_REPORT 861
47203 - LOG_ID_ENTER_BYPASS 862
47204 - LOG_ID_EXIT_BYPASS 863
48000 - LOG_ID_WAD_SSL_RCV_HS 863
48001 - LOG_ID_WAD_SSL_RCV_WRG_HS 864
48002 - LOG_ID_WAD_SSL_SENT_HS 865
48003 - LOG_ID_WAD_SSL_WRG_HS_LEN 866
48004 - LOG_ID_WAD_SSL_RCV_CCS 867
48005 - LOG_ID_WAD_SSL_RSA_DH_FAIL 868
48006 - LOG_ID_WAD_SSL_SENT_CCS 869
48007 - LOG_ID_WAD_SSL_BAD_HASH 870
48009 - LOG_ID_WAD_SSL_DECRY_FAIL 871
48011 - LOG_ID_WAD_SSL_LESS_MINOR 872
48013 - LOG_ID_WAD_SSL_NOT_SUPPORT_CS 872
48016 - LOG_ID_WAD_SSL_HS_FIN 873
48017 - LOG_ID_WAD_SSL_HS_TOO_LONG 874
48019 - LOG_ID_WAD_SSL_SENT_ALERT 875
48023 - LOG_ID_WAD_SSL_RCV_ALERT 876
48027 - LOG_ID_WAD_SSL_INVALID_CONT_TYPE 877
48029 - LOG_ID_WAD_SSL_BAD_CCS_LEN 878
48031 - LOG_ID_WAD_SSL_BAD_DH 879
48032 - LOG_ID_WAD_SSL_PUB_KEY_TOO_BIG 880
48034 - LOG_ID_WAD_SSL_SERVER_KEY_HASH_ALGORITHM_MISMATCH 881
48035 - LOG_ID_WAD_SSL_SERVER_KEY_SIGNATURE_ALGORITHM_
MISMATCH 881
48038 - LOG_ID_WAD_SSL_RCV_FATAL_ALERT 882
48039 - LOG_ID_WAD_SSL_SENT_FATAL_ALERT 883
48101 - LOG_ID_WAD_AUTH_FAIL_PSK 884
48102 - LOG_ID_WAD_AUTH_FAIL_OTH 885
48300 - LOG_ID_WRG_SVR_FGT_CONF 886
48301 - LOG_ID_UNEXP_APP_TYPE 887
51000 - LOG_ID_NB_TBL_CHG 888
52000 - LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_SUMMARY 889
53000 - LOG_ID_SDNC_CONNECTED 890

FortiOS 6.0.10 Log Reference 22

Fortinet, Inc.
53001 - LOG_ID_SDNC_DISCONNECTED 890
53002 - LOG_ID_SDNC_SUBSCRIBE 891
53003 - LOG_ID_SDNC_UNSUBSCRIBE 892
99951 - LOG_ID_NP6_IPSEC_ENGINE_BUSY 892
99952 - LOG_ID_NP6_IPSEC_ENGINE_POSSIBLY_LOCKUP 893
99953 - LOG_ID_NP6_IPSEC_ENGINE_LOCKUP 894
GTP 894
41216 - LOGID_GTP_FORWARD 894
41217 - LOGID_GTP_DENY 896
41218 - LOGID_GTP_RATE_LIMIT 897
41219 - LOGID_GTP_STATE_INVALID 898
41220 - LOGID_GTP_TUNNEL_LIMIT 900
41221 - LOGID_GTP_TRAFFIC_COUNT 901
41222 - LOGID_GTP_USER_DATA 903
41223 - LOGID_GTPV2_FORWARD 904
41224 - LOGID_GTPV2_DENY 905
41225 - LOGID_GTPV2_RATE_LIMIT 906
41226 - LOGID_GTPV2_STATE_INVALID 907
41227 - LOGID_GTPV2_TUNNEL_LIMIT 909
41228 - LOGID_GTPV2_TRAFFIC_COUNT 910
41229 - LOGID_GTPU_FORWARD 911
41230 - LOGID_GTPU_DENY 912
IPS 913
16384 - LOGID_ATTCK_SIGNATURE_TCP_UDP 913
16385 - LOGID_ATTCK_SIGNATURE_ICMP 915
16386 - LOGID_ATTCK_SIGNATURE_OTHERS 917
16399 - LOGID_ATTACK_MALICIOUS_URL 918
SSH 920
61000 - LOG_ID_SSH_COMMAND_BLOCK 920
61001 - LOG_ID_SSH_COMMAND_BLOCK_ALERT 921
61002 - LOG_ID_SSH_COMMAND_PASS 923
61003 - LOG_ID_SSH_COMMAND_PASS_ALERT 924
61010 - LOG_ID_SSH_CHANNEL_BLOCK 925
61011 - LOG_ID_SSH_CHANNEL_PASS 926
Traffic 928
2 - LOG_ID_TRAFFIC_ALLOW 928
3 - LOG_ID_TRAFFIC_DENY 931
4 - LOG_ID_TRAFFIC_OTHER_START 934
5 - LOG_ID_TRAFFIC_OTHER_ICMP_ALLOW 937
6 - LOG_ID_TRAFFIC_OTHER_ICMP_DENY 940
7 - LOG_ID_TRAFFIC_OTHER_INVALID 943
8 - LOG_ID_TRAFFIC_WANOPT 946
9 - LOG_ID_TRAFFIC_WEBCACHE 949
10 - LOG_ID_TRAFFIC_EXPLICIT_PROXY 951
11 - LOG_ID_TRAFFIC_FAIL_CONN 954
12 - LOG_ID_TRAFFIC_MULTICAST 955
13 - LOG_ID_TRAFFIC_END_FORWARD 958
14 - LOG_ID_TRAFFIC_END_LOCAL 962
15 - LOG_ID_TRAFFIC_START_FORWARD 965

FortiOS 6.0.10 Log Reference 23

Fortinet, Inc.
16 - LOG_ID_TRAFFIC_START_LOCAL 968
17 - LOG_ID_TRAFFIC_SNIFFER 971
19 - LOG_ID_TRAFFIC_BROADCAST 975
20 - LOG_ID_TRAFFIC_STAT 978
21 - LOG_ID_TRAFFIC_SNIFFER_STAT 981
22 - LOG_ID_TRAFFIC_UTM_CORRELATION 984
VoIP 988
44032 - LOGID_EVENT_VOIP_SIP 988
44033 - LOGID_EVENT_VOIP_SIP_BLOCK 989
44034 - LOGID_EVENT_VOIP_SIP_FUZZING 991
44035 - LOGID_EVENT_VOIP_SCCP_REGISTER 992
44036 - LOGID_EVENT_VOIP_SCCP_UNREGISTER 993
44037 - LOGID_EVENT_VOIP_SCCP_CALL_BLOCK 994
44038 - LOGID_EVENT_VOIP_SCCP_CALL_INFO 996
WAF 997
30248 - LOGID_WAF_SIGNATURE_BLOCK 997
30249 - LOGID_WAF_SIGNATURE_PASS 998
30250 - LOGID_WAF_SIGNATURE_ERASE 1000
30251 - LOGID_WAF_CUSTOM_SIGNATURE_BLOCK 1001
30252 - LOGID_WAF_CUSTOM_SIGNATURE_PASS 1003
30253 - LOGID_WAF_METHOD_BLOCK 1004
30255 - LOGID_WAF_ADDRESS_LIST_BLOCK 1006
30257 - LOGID_WAF_CONSTRAINTS_BLOCK 1007
30258 - LOGID_WAF_CONSTRAINTS_PASS 1009
30259 - LOGID_WAF_URL_ACCESS_PERMIT 1010
30260 - LOGID_WAF_URL_ACCESS_BYPASS 1011
30261 - LOGID_WAF_URL_ACCESS_BLOCK 1013
Web 1014
12288 - LOG_ID_WEB_CONTENT_BANWORD 1014
12289 - LOG_ID_WEB_CONTENT_MMS_BANWORD 1016
12290 - LOG_ID_WEB_CONTENT_EXEMPTWORD 1018
12291 - LOG_ID_WEB_CONTENT_MMS_EXEMPTWORD 1020
12292 - LOG_ID_WEB_CONTENT_KEYWORD 1021
12293 - LOG_ID_WEB_CONTENT_SEARCH 1023
12305 - LOG_ID_WEB_CONTENT_MMS_BANWORD_NOTIF 1025
12544 - LOG_ID_URL_FILTER_BLOCK 1027
12545 - LOG_ID_URL_FILTER_EXEMPT 1028
12546 - LOG_ID_URL_FILTER_ALLOW 1030
12547 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTP_BLK 1032
12548 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTPS_BLK 1033
12549 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTP_PASS 1035
12550 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTPS_PASS 1036
12551 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_SNI_BLK 1038
12552 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_SNI_PASS 1039
12553 - LOG_ID_URL_FILTER_INVALID_CERT 1041
12554 - LOG_ID_URL_FILTER_INVALID_SESSION 1042
12555 - LOG_ID_URL_FILTER_SRV_CERT_ERR_BLK 1044
12556 - LOG_ID_URL_FILTER_SRV_CERT_ERR_PASS 1045
12557 - LOG_ID_URL_FILTER_FAMS_NOT_ACTIVE 1046

FortiOS 6.0.10 Log Reference 24

Fortinet, Inc.
12558 - LOG_ID_URL_FILTER_RATING_ERR 1047
12559 - LOG_ID_URL_FILTER_PASS 1048
12560 - LOG_ID_URL_WISP_BLOCK 1050
12561 - LOG_ID_URL_WISP_REDIR 1052
12562 - LOG_ID_URL_WISP_ALLOW 1053
12688 - LOG_ID_WEB_SSL_EXEMPT 1055
12800 - LOG_ID_WEB_FTGD_ERR 1056
12801 - LOG_ID_WEB_FTGD_WARNING 1058
12802 - LOG_ID_WEB_FTGD_QUOTA 1060
13056 - LOG_ID_WEB_FTGD_CAT_BLK 1061
13057 - LOG_ID_WEB_FTGD_CAT_WARN 1063
13312 - LOG_ID_WEB_FTGD_CAT_ALLOW 1064
13313 - LOG_ID_WEB_FTGD_RULE_ALLOW 1066
13314 - LOG_ID_WEB_FTGD_OFF_SITE_ALLOW 1068
13315 - LOG_ID_WEB_FTGD_QUOTA_COUNTING 1070
13316 - LOG_ID_WEB_FTGD_QUOTA_EXPIRED 1072
13317 - LOG_ID_WEB_URL 1074
13568 - LOG_ID_WEB_SCRIPTFILTER_ACTIVEX 1075
13573 - LOG_ID_WEB_SCRIPTFILTER_COOKIE 1077
13584 - LOG_ID_WEB_SCRIPTFILTER_APPLET 1079
13600 - LOG_ID_WEB_SCRIPTFILTER_OTHER 1080
13601 - LOG_ID_WEB_WF_COOKIE 1082
13602 - LOG_ID_WEB_WF_REFERER 1084
13603 - LOG_ID_WEB_WF_COMMAND_BLOCK 1085
13616 - LOG_ID_CONTENT_TYPE_BLOCK 1087
13632 - LOGID_HTTP_HDR_CHG_REQ 1088
13633 - LOGID_HTTP_HDR_CHG_RESP 1089

FortiOS 6.0.10 Log Reference 25

Fortinet, Inc.
Change Log

Date Change Description

2020-06-18 Initial release.

FortiOS 6.0.10 Log Reference 26

Fortinet, Inc.
Introduction

This document provides information about all the log messages applicable to the FortiGate devices running FortiOS
version 6.0.10 or higher. The logs are intended for administrators to use as reference for more information about a
specific log entry and message generated by FortiOS.
This document also provides information about log fields when FortiOS sends log messages to remote syslog servers in
Common Event Format (CEF). See CEF Support on page 43. It also describes how to enable extended logging. See
UTM Extended Logging on page 54.

Performance statistics are not logged to disk. Performance statistics can be received by a
syslog server or by FortiAnalyzer.

Before you begin

Before you begin using this reference, read the following notes:
l Information in this document applies to all FortiGate units that are currently running FortiOS 6.0.10 or higher.
l Ensure that you have enabled logging for the FortiOS unit. For more information, see the Logging and Reporting
chapter in the FortiOS Handbook.
l Each log message is displayed in the Log & Report pane of the GUI. You can also download the RAW format from
the Log & Report pane.
l Each log message is documented similar to how it appears in the RAW format. For more information, see the
Logging and Reporting chapter in the FortiOS Handbook.

This reference contains detailed information for each log type and subtype; however, this
reference contains only information gathered at publication and, as a result, not every log
message field contains detailed information.

Overview

The log types described in this document report traffic, security, and event log information useful for system
administrators when recording, monitoring, and tracing the operation of a FortiGate device running FortiOS. The logs
provide information regarding the following:
l Firewall attacks
l Configuration changes
l Successful and unsuccessful system operations

FortiOS 6.0.10 Log Reference 27

Fortinet, Inc.
Introduction

What's new

This section identifies major changes in the Log Reference from version 6.0.0 and later.

FortiOS 6.0.10

There are no major log changes between FortiOS 6.0.9 and 6.0.10.

FortiOS 6.0.9

There are no major log changes between FortiOS 6.0.8 and 6.0.9.

FortiOS 6.0.8

There are no major log changes between FortiOS 6.0.7 and 6.0.8.

FortiOS 6.0.7

There are no major log changes between FortiOS 6.0.6 and 6.0.7.

FortiOS 6.0.6

There are no major log changes between FortiOS 6.0.5 and 6.0.6.

FortiOS 6.0.5

There are no major log changes between FortiOS 6.0.4 and 6.0.5.

FortiOS 6.0.4

There are no major log changes between FortiOS 6.0.3 and 6.0.4.

FortiOS 6.0.3

There are no major log changes between FortiOS 6.0.2 and 6.0.3.

FortiOS 6.0.2

There are no major log changes between FortiOS 6.0.1 and 6.0.2.

FortiOS 6.0.10 Log Reference 28

Fortinet, Inc.
Introduction

FortiOS 6.0.1

There are no major log changes between FortiOS 6.0.0 and 6.0.1.

FortiOS 6.0.0

SSH

l SSH (Secure Socket Shell) was added as a new log type with a log ID of 16.

Extended logging

l Extended logging is supported for UTM log types. A new rawdata field contains the information, and the full
information is available when sending extended logs to reliable Syslog servers. See UTM Extended Logging on
page 54.

As of FortiOS 5.6.0, the value of every string type field is now enclosed in double quotes.

FortiOS 6.0.10 Log Reference 29

Fortinet, Inc.
Log Types and Subtypes

This section describes the log types, subtypes, and priority levels. It also describes the log field format.

Type

Each log entry contains a Type (type) or category field that indicates its log type and which log file stores the log entry.

Subtype

Each log entry contains a Sub Type (subtype) or subcategory field within a log type, based on the feature associated
with the cause of the log entry.
For example:
l In event logs, some log entries have a subtype of user, system, or other subtypes.
l In traffic logs, the subtypes are: local, forward, multicast, and sniffer.

List of log types and subtypes

FortiGate devices can record the following types and subtypes of log entry information:

Type Description Subtype

Traffic Records traffic flow information, such as an l Forward

HTTP/HTTPS request and its response, if l Local
any. l Multicast
l Sniffer

Event Records system and administrative events, l Compliance-check

such as downloading a backup copy of the l Endpoint Control
configuration, or daemon activities. l High Availability
l Router
l Security-audit
l System
l User
l Virtual Private Network (VPN)
l WAD
l Wireless

UTM Records UTM events. See list of UTM log subtypes below

FortiOS 6.0.10 Log Reference 30

Fortinet, Inc.
Log Types and Subtypes

UTM log subtypes

UTM Log Subtypes Description Event Type

Anomaly Records intrusion attempts. l Anomaly

App Records intrusion attempts. Application l App-CTRL-All

Control log is output when a signature
matches an application pattern.

Antivirus Records virus attacks. l Analytics

l Botnet
l Filename
l Filetype Executable
l Infected
l Mime Fragmented
l Outbreak-prevention
l Oversized
l Scan Error
l Suspicious
l Switch Proto

DLP Records data leak prevention events. l DLP

l Document Source

DNS Records domain name server events. l DNS-query

l DNS-response

Email Records email filter events. l Carrier Endpoint Filter

l FTGD Error
l Google Gmail
l IMAP
l MAPI
l MMS
l MSN Hotmail
l POP3
l SMTP
l Yahoo Mail

GTP Records GPRS Tunneling Protocol (GTP) l GTP-All

traffic for FortiCarrier devices.

IPS Records intrusion prevention events. l Malicious URL

l Signature

VoIP Records voice over IP events. l VoIP

SSH Records Secure Socket Shell events. l SSH

WAF Records web application firewall information l Address List

for FortiWeb appliances and virtual l Custom Signature
appliances l HTTP Constraint

FortiOS 6.0.10 Log Reference 31

Fortinet, Inc.
Log Types and Subtypes

UTM Log Subtypes Description Event Type

l HTTP Method
l Signature
l URL Access

Web Filtering Records web filter events. l ActiveX Filter

l Applet Filter
l Command Block
l Content
l Cookie Filter
l FortiGuard Allow
l FortiGuard Block
l FortiGuard Error
l FortiGuard Quota
l FortiGuard Quota Counting
l FortiGuard Quota Expired
l Script Filter
l URL Filter
l URL Monitor

FortiOS priority levels

Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry,
such as level=warning, and therefore how high a priority it is likely to be. Level (level) associations with the
descriptions below are not always uniform. They also may not correspond with your own definitions of how severe each
event is. If you require notification when a specific event occurs, either configure SNMP traps or alert email by
administrator-defined Severity Level (severity_level) or ID (logid), not by Level (level).

Level (0 is highest) Name Description

0 Emergency The system is unusable or not responding.

1 Alert Immediate action required. Used in security logs.

2 Critical Functionality is affected.

3 Error An error exists and functionality could be affected.

4 Warning Functionality could be affected.

5 Notification Information about normal events.

6 Information General information about system operations. Used in event logs to

record configuration changes.

For each location where the FortiGate device can store log files (disk, memory, Syslog or FortiAnalyzer), you can define
a severity threshold. FortiOS stores all log messages equal to or exceeding the log severity level selected. For example,
if you select Error, FortiOS will store log messages whose log severity level is Error, Critical, Alert, and Emergency.

FortiOS 6.0.10 Log Reference 32

Fortinet, Inc.
Log Types and Subtypes

Log field format

The following table describes the standard format in which each log type is described in this document. For
documentation purposes, all log types and subtypes follow this generic table format to present the log entry information.

Log Field Name Description Data Type Length

appact The security action from app control string 16

FortiOS 6.0.10 Log Reference 33

Fortinet, Inc.
Log Schema Structure

This section describes the schema of the FortiOS log messages.

Log message fields

Each log message consists of several sections of fields. In the FortiOS GUI, you can view the logs in the Log & Report
pane, which displays the formatted view. If you want to view logs in raw format, you must download the log and view it
in a text editor.
Following is an example of a traffic log message in raw format:
date=2017-11-15 time=11:44:16 logid="0000000013" type="traffic" subtype="forward"
level="notice" vd="vdom1" eventtime=1510775056 srcip=10.1.100.155 srcname="pc1"
srcport=40772 srcintf="port12" srcintfrole="undefined" dstip=35.197.51.42
dstname="fortiguard.com" dstport=443 dstintf="port11" dstintfrole="undefined"
poluuid="707a0d88-c972-51e7-bbc7-4d421660557b" sessionid=8058 proto=6 action="close"
policyid=1 policytype="policy" policymode="learn" service="HTTPS" dstcountry="United
States" srccountry="Reserved" trandisp="snat" transip=172.16.200.2 transport=40772
appid=40568 app="HTTPS.BROWSER" appcat="Web.Client" apprisk="medium" duration=2
sentbyte=1850 rcvdbyte=39898 sentpkt=25 rcvdpkt=37 utmaction="allow" countapp=1
devtype="Linux PC" osname="Linux" mastersrcmac="a2:e9:00:ec:40:01"
srcmac="a2:e9:00:ec:40:01" srcserver=0 utmref=0-220586

The following table provides an example of the log field information in the FortiOS GUI in the detailed view of the Log &
Report pane and in the downloaded, raw log file.

GUI Field Name Field Description Example Field Value in Raw Format

(Raw Field Name)

General
Date (date) Day, month, and year when the log date=2017-11-15
message was recorded.

Time (time) Hour clock when the log message was time=11:44:16

recorded.

Duration (duration) Duration of the session. duration=2

Session ID (sessionid) ID for the session. sessionid=8058

Virtual Domain (vd) Name of the virtual domain in which the vd="vdom1"
log message was recorded.

NAT Translation NAT source port. transport=40772

(transport)

Source

FortiOS 6.0.10 Log Reference 34

Fortinet, Inc.
Log Schema Structure

GUI Field Name Field Description Example Field Value in Raw Format

(Raw Field Name)

IP (srcip) IP address of the traffic’s origin. The srcip=10.1.100.155

source varies by the direction:
l In HTTP requests, this is the web
browser or other client.
l In HTTP responses, this is the
physical server.

NAT IP (transip) NAT source IP. transip=172.16.200.2

Source Port (srcport) Port number of the traffic's origin. srcport=40772

Country (srccountry) Name of the source country. srccountry="Reserved"

Source Interface(srcintf) Interface name of the traffic's origin. srcintf="port12"

Source Name (srcname) Name of the source. srcname="pc1"

Source Interface Name Name of the source interface. srcintfrole="undefined"

(srcintfrole)

Device Type (devtype) Device type of the source. devtype="Linux PC"

OS Name (osname) OS of the source. osname="Linux"

Master Source MAC  The master MAC address for a host mastersrcmac="a2:e9:00:ec:40:01"
(mastersrcmac) that has multiple network interfaces.

Source MAC (srcmac) MAC address associated with the srcmac="a2:e9:00:ec:40:01"

source IP address.

Source Server (srcserver) Server of the source. srcserver=0

Device ID (devid) Serial number of the device for the devid="FGVM02Q105060010"

traffic's origin.

Destination
IP (dstip) Destination IP address for the web. dstip=35.197.51.42

Port (dstport) Port number of the traffic's destination. dstport=443

Country (dstcountry) Name of the destination country. dstcountry="United States"

Destination Interface Interface of the traffic's destination. dstintf="port11"

(dstintf)

Destination Name Name of the destination. dstname="fortiguard.com"

(dstname)

Destination Interface Name of the destination interface. dstintfrole="undefined"

Name (dstinfrole)

Application

FortiOS 6.0.10 Log Reference 35

Fortinet, Inc.
Log Schema Structure

GUI Field Name Field Description Example Field Value in Raw Format

(Raw Field Name)

Application Name (app) Name of the application. app="HTTPS.BROWSER"

Category (appcat) Category of the application. appcat="Web.Client"

Service (service) Name of the service. service="HTTPS"

Application ID (appid) ID of the application. appid=40568

Application Risk (apprisk) Risk level of the application. apprisk="medium"

countapp Number of App Ctrl logs associated countapp=1

with the session.

Data
Received bytes Number of bytes received. rcvdbyte=39898
(rcvdbyte)

Received packets Number of packets received. rcvdpkt=37

(rcvdpkt)

Sent bytes (sentbyte) Number of bytes sent. sentbyte=1850

Sent packets (sentpkt) Number of packets sent. sentpkt=25

Action
Action (action) Status of the session. Uses following action=close
definitions:
l Deny: blocked by firewall policy
l Start: session start log (special
option to enable logging at start of
a session). This means firewall
allowed.
l All Others: allowed by Firewall
Policy and the status indicates how
it was closed.

Policy (policyid) Name of the firewall policy governing policyid=1

the traffic which caused the log
message.

Policy UUID (poluuid) UUID for the firewall policy. poluuid="707a0d88-c972-51e7-bbc7-

4d421660557b"

Policy Type (policytype) policytype="policy"

Policy Mode Firewall policy mode. policymode="learn"

(policymode)

Security
Level (level) Security level rating. level="notice"

FortiOS 6.0.10 Log Reference 36

Fortinet, Inc.
Log Schema Structure

GUI Field Name Field Description Example Field Value in Raw Format

(Raw Field Name)

Other
Event Time (eventtime) Epoch time the log was triggered by eventtime=1510775056
FortiGate. If you convert the epoch
time to human readable time, it might
not match the Date and Time in the
header owing to a small delay between
the time the log was triggered and
recorded. The Log Time field is the
same for the same log among all log
devices, but the Date and Time might
differ.

Protocol Number (proto) tcp: The protocol used by web traffic proto=6

(tcp by default)

Type (type) Log type. See Type on page 30 type="traffic"

Log ID (logid) Log ID. See Log ID definitions on page logid="0000000013"

38

Sub Type(subtype)  Subtype of the traffic. See Subtype on subtype="forward"

page 30.

trandisp NAT translation type. trandisp="snat"

UTM Action (utmaction) Security action performed by UTM. utmaction="allow"

UTM Reference (utmref) UTM reference number. utmref=0-220586

UTM Reference (utmref) UTM reference number. utmref=0-220586

Log ID numbers

The ID (logid) is a 10-digit field. It is a unique identifier for that specific log and includes the following information about
the log entry.

Log ID number Description Examples

components

Log Type Represented by the first two digits of l Traffic log IDs begin with "00".
the log ID. l Event log IDs begin with "01".

Sub Type or Event Type Represented by the second two digits l VPN log subtype is represented with
of the log ID. "01" which belongs to the Event log type
that is represented with "01".
Therefore, all VPN related Event log IDs
will begin with the 0101 log ID series.

FortiOS 6.0.10 Log Reference 37

Fortinet, Inc.
Log Schema Structure

Log ID number Description Examples

components

Message ID The last six digits of the log ID l An administrator account always has the
represent the message ID. log ID 0000003401.

The logid field is a number assigned to all permutations of the same message. It classifies a log entry by the nature of
the cause of the log message, such as administrator authentication failures or traffic. Other log messages that share the
same cause will share the same logid.

Log ID definitions

Following are the definitions for the log type IDs and subtype IDs applicable to FortiOS version 5.2.1 and later.

Log Type IDs Subtype IDs

traffic: 0 l forward: 0
l local: 1
l multicast: 2
l sniffer: 4

event: 1 l system: 0
l vpn: 1
l user: 2
l router: 3
l wireless: 4
l wad: 5
l endpoint: 7
l ha: 8
l compliance-check: 9
l security_audit: 10

virus: 2 l infected: 11
l blocked: 12
l oversized: 13
l scanerror: 62
l suspicious: 0
l analytics: 1
l switchproto: 63
l mimefragmented: 61
l virus_filetype_exe: 3
l botnet: 2

webfilter: 3 l content: 14
l urlfilter: 15
l ftgd_blk: 16
l ftgd_allow: 17

FortiOS 6.0.10 Log Reference 38

Fortinet, Inc.
Log Schema Structure

Log Type IDs Subtype IDs

l ftgd_err: 18
l url_monitor: 19
l scriptfilter_activex: 35
l scriptfilter_ cookie: 36
l scriptfilter_applet: 37
l ftgd_quota_counting: 38
l ftgd_quota_expired: 39
l ftgd_quota: 40
l scriptfilter_other: 41
l webfilter_command_block: 43

ips: 4 l signature: 19
l malicious_url: 21

antispam: 5 l smtp: 8
l pop3: 9
l imap: 10
l mapi: 11
l endpoint_filter: 47
l mms: 52
l msn: 5
l yahoo: 6
l google: 7
l ftgd_err: 53

anomaly: 7 l anomaly: 20

voip: 8 l viop: 14

dlp: 9 l dlp: 54
l dlp-docsource: 55

app_ctrl: 10 l app-ctrl-all: 59

WAF: 12 l signature: 0
l custom_signature: 1
l method: 2
l constraints: 3
l address_list: 4
l url_access: 5

GTP: 14 l all: 0

DNS: 15 l dns-query: 0
l dns-response: 1

SSH: 16 l ssh-command: 0
l ssh-channel: 1

FortiOS 6.0.10 Log Reference 39

Fortinet, Inc.
FortiGuard Web Filter Categories

The below details the mapping between FortiGuard Web Filter category names and numbers.

Number Category

0 Unrated

1 Drug abuse

2 Alternative beliefs

3 Hacking

4 Illegal or unethical

5 Discrimination

6 Explicit violence

7 Abortion

8 Other adult materials

9 Advocacy organizations

11 Gambling

12 Extremist groups

13 Nudity and risque

14 Pornography

15 Dating

16 Weapons (sales)

17 Advertising

18 Brokerage and trading

19 Freeware and software downloads

20 Games

23 Web-based email

24 File sharing and storage

25 Streaming media and download

26 Malicious websites

28 Entertainment

29 Arts and culture

30 Education

FortiOS 6.0.10 Log Reference 40

Fortinet, Inc.
FortiGuard Web Filter Categories

Number Category

31 Finance and banking

33 Health and wellness

34 Job search

35 Medicine

36 News and media

37 Social networking

38 Political organizations

39 Reference

40 Global religion

41 Search engines and portals

42 Shopping

43 General organizations

44 Society and lifestyles

46 Sports

47 Travel

48 Personal vehicles

49 Business

50 Information and computer security

51 Government and legal organizations

52 Information technology

53 Armed forces

54 Dynamic content

55 Meaningless content

56 Web hosting

57 Marijuana

58 Folklore

59 Proxy avoidance

61 Phishing

62 Plagiarism

63 Sex education

FortiOS 6.0.10 Log Reference 41

Fortinet, Inc.
FortiGuard Web Filter Categories

Number Category

64 Alcohol

65 Tobacco

66 Lingerie and swimsuit

67 Sports hunting and war games

68 Web chat

69 Instant messaging

70 Newsgroups and message boards

71 Digital postcards

72 Peer-to-peer file sharing

75 Internet radio and TV

76 Internet telephony

77 Child education

78 Real estate

79 Restaurant and dining

80 Personal websites and blogs

81 Secure websites

82 Content servers

83 Child abuse

84 Web-based applications

85 Domain parking

86 Spam URLs

87 Personal privacy

88 Dynamic DNS

89 Auction

90 Newly observed domain

91 Newly registered domain

92 Charitable organizations

93 Remote access

94 Web analytics

95 Online meeting

FortiOS 6.0.10 Log Reference 42

Fortinet, Inc.
CEF Support

You can configure FortiOS 6.0.10 to send logs to remote syslog servers in Common Event Format (CEF) by using the
config log syslogd setting command. For more information, see the Logging and Reporting chapter in the
FortiOS Handbook and the FortiOS CLI Reference.
When CEF is enabled, FortiOS sends logs to syslog servers in CEF. This section describes how FortiOS logs support
CEF.

You can view logs in CEF on remote syslog servers or FortiAnalyzer, but not in the FortiOS
GUI.

FortiOS to CEF log field mapping guidelines

The following CEF format:

Date/Time host CEF:Version|Device Vendor|Device Product|Device Version|Signature
ID|Name|Severity|[Extension]

Displays as following in FortiOS logs with CEF enabled: 

"MMM dd HH:mm:ss" "hostname of the fortigate"
CEF:0|Fortinet|Fortigate|version|logid|type:subtype +[eventtype] +[action] +
[status]|reversed level|...

The SignatureId field in FortiOS logs maps to the logid field in CEF and should be last 5 digits of logid.
The Name field in CEF uses the following formula:
type:subtype + [eventtype] + [action] + [status]

Following is an example of the header and one key-value pair for extension from the Event VPN log in CEF:
#Feb 12 10:31:04 syslog-800c CEF:0|Fortinet|Fortigate|v5.6.0|37127|event:vpn negotiate
success|3|FTNTFGTlogid=0101037127

The type:subtype field in FortiOS logs maps to the cat field in CEF.
Any fields in FortiOS logs that are unmatched to fields in CEF include the FTNTFGT prefix.
Quotes ("") are removed from FortiOS logs to support CEF.
Forward slashes (//) in string values as well as the equal sign (=) and backward slashes (\) are escaped in FortiOS logs
to support CEF.

FortiOS 6.0.10 Log Reference 43

Fortinet, Inc.
CEF Support

CEF priority levels

Following are the CEF priority levels. They are opposite of FortiOS priority levels. See also FortiOS priority levels on
page 32.

Level (8 is highest) Name Description

8 Emergency The system is unusable or not responding.

7 Alert Immediate action required. Used in security logs.

6 Critical Functionality is affected.

5 Error An error exists and functionality could be affected.

4 Warning Functionality could be affected.

3 Notification Information about normal events.

2 Information General information about system operations. Used in event logs to

record configuration changes.

1 Debug Debug information.

Examples of CEF support

This section includes examples of how the different types of log message support CEF.

Traffic log support for CEF

The following is an example of a traffic log on the FortiGate disk:

date=2018-12-27 time=11:07:55 logid="0000000013" type="traffic" subtype="forward"
level="notice" vd="vdom1" eventtime=1545937675 srcip=10.1.100.11 srcport=54190
srcintf="port12" srcintfrole="undefined" dstip=52.53.140.235 dstport=443
dstintf="port11" dstintfrole="undefined" poluuid="c2d460aa-fe6f-51e8-9505-
41b5117dfdd4" sessionid=402 proto=6 action="close" policyid=1 policytype="policy"
service="HTTPS" dstcountry="United States" srccountry="Reserved" trandisp="snat"
transip=172.16.200.1 transport=54190 appid=40568 app="HTTPS.BROWSER"
appcat="Web.Client" apprisk="medium" applist="g-default" duration=2 sentbyte=3652
rcvdbyte=146668 sentpkt=58 rcvdpkt=105 utmaction="allow" countapp=2 utmref=65532-56

The following is an example of a traffic log sent in CEF format to a syslog server:
Dec 27 11:07:55 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|00013|traffic:forward
close|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0000000013 cat=traffic:forward
FTNTFGTsubtype=forward FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545937675
src=10.1.100.11 spt=54190 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined
dst=52.53.140.235 dpt=443 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined
FTNTFGTpoluuid=c2d460aa-fe6f-51e8-9505-41b5117dfdd4 externalId=402 proto=6 act=close
FTNTFGTpolicyid=1 FTNTFGTpolicytype=policy app=HTTPS FTNTFGTdstcountry=United States
FTNTFGTsrccountry=Reserved FTNTFGTtrandisp=snat sourceTranslatedAddress=172.16.200.1
sourceTranslatedPort=54190 FTNTFGTappid=40568 FTNTFGTapp=HTTPS.BROWSER
FTNTFGTappcat=Web.Client FTNTFGTapprisk=medium FTNTFGTapplist=g-default

FortiOS 6.0.10 Log Reference 44

Fortinet, Inc.
CEF Support

FTNTFGTduration=2 out=3652 in=146668 FTNTFGTsentpkt=58 FTNTFGTrcvdpkt=105

FTNTFGTutmaction=allow FTNTFGTcountapp=2

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

type: subtype cat

srcip src

srcport spt

srcintf deviceInboundInterface

dstip dst

dstport dpt

dstintf deviceOutboundInterface

sessionid externalID

proto proto

action act

transip sourceTranslatedAddress

transport sourceTranslatedPort

service app

sentbyte out

rcvdbyte in

Custom fields

To configure the traffic log with custom fields, enter the following CLI commands:
config log custom-field
edit 1
set name "custom_name1"
set value "HN123456"
next
edit 2
set name "custom_name2"
set value "accounting_dpt"
next
end
config firewall policy
edit 1
set name "A-v4-out"
set uuid c2d460aa-fe6f-51e8-9505-41b5117dfdd4
set srcintf "port12"
set dstintf "port11"
set srcaddr "all"
set dstaddr "all"
set action accept

FortiOS 6.0.10 Log Reference 45

Fortinet, Inc.
CEF Support

set schedule "always"

set service "ALL"
set utm-status enable
set logtraffic all
set custom-log-fields "1" "2"
set application-list "g-default"
set ssl-ssh-profile "certificate-inspection"
set nat enable
next
end

The following is an example of a traffic log with custom fields on the FortiGate disk:
date=2018-12-27 time=11:12:30 logid="0000000013" type="traffic" subtype="forward"
level="notice" vd="vdom1" eventtime=1545937950 srcip=10.1.100.11 srcport=58843
srcintf="port12" srcintfrole="undefined" dstip=172.16.200.55 dstport=53
dstintf="port11" dstintfrole="undefined" poluuid="c2d460aa-fe6f-51e8-9505-
41b5117dfdd4" sessionid=440 proto=17 action="accept" policyid=1 policytype="policy"
service="DNS" dstcountry="Reserved" srccountry="Reserved" trandisp="snat"
transip=172.16.200.1 transport=58843 appid=16195 app="DNS" appcat="Network.Service"
apprisk="elevated" applist="g-default" duration=180 sentbyte=70 rcvdbyte=528 sentpkt=1
rcvdpkt=1 custom_name1="HN123456" custom_name2="accounting_dpt"

The following is an example of a traffic log with custom fields sent in CEF format to a syslog server:
Dec 27 11:12:30 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|00013|traffic:forward
accept|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0000000013 cat=traffic:forward
FTNTFGTsubtype=forward FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545937950
src=10.1.100.11 spt=58843 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined
dst=172.16.200.55 dpt=53 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined
FTNTFGTpoluuid=c2d460aa-fe6f-51e8-9505-41b5117dfdd4 externalId=440 proto=17 act=accept
FTNTFGTpolicyid=1 FTNTFGTpolicytype=policy app=DNS FTNTFGTdstcountry=Reserved
FTNTFGTsrccountry=Reserved FTNTFGTtrandisp=snat sourceTranslatedAddress=172.16.200.1
sourceTranslatedPort=58843 FTNTFGTappid=16195 FTNTFGTapp=DNS
FTNTFGTappcat=Network.Service FTNTFGTapprisk=elevated FTNTFGTapplist=g-default
FTNTFGTduration=180 out=70 in=528 FTNTFGTsentpkt=1 FTNTFGTrcvdpkt=1 FTNTFGTcustom_
name1=HN123456 FTNTFGTcustom_name2=accounting_dpt

The following table maps FortiOS custom log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

custom_name1 FTNTFGTcustom_name1

custom_name2 FTNTFGTcustom_name2

Event log support for CEF

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

msg msg

cookies requestCookies

user duser

FortiOS 6.0.10 Log Reference 46

Fortinet, Inc.
CEF Support

FortiOS Log Field Name CEF Field Name

status outcome

role sourceServiceName

ui sproc

reason reason

action act

system subtype

The following is an example of a system subtype event log on the FortiGate disk:
date=2018-12-27 time=11:15:40 logid="0100032002" type="event" subtype="system" level="alert"
vd="vdom1" eventtime=1545938140 logdesc="Admin login failed" sn="0" user="admin1"
ui="https(172.16.200.254)" method="https" srcip=172.16.200.254 dstip=172.16.200.1
action="login" status="failed" reason="name_invalid" msg="Administrator admin1 login
failed from https(172.16.200.254) because of invalid user name"

The following is an example of a system subtype event log sent in CEF format to a syslog server:
Dec 27 11:15:40 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|32002|event:system login
failed|7|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0100032002 cat=event:system
FTNTFGTsubtype=system FTNTFGTlevel=alert FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938140
FTNTFGTlogdesc=Admin login failed FTNTFGTsn=0 duser=admin1 sproc=https(172.16.200.254)
FTNTFGTmethod=https src=172.16.200.254 dst=172.16.200.1 act=login outcome=failed
reason=name_invalid msg=Administrator admin1 login failed from https(172.16.200.254)
because of invalid user name

user subtype

The following is an example of a user subtype log on the FortiGate disk:

date=2018-12-27 time=11:17:35 logid="0102043008" type="event" subtype="user" level="notice"
vd="vdom1" eventtime=1545938255 logdesc="Authentication success" srcip=10.1.100.11
dstip=172.16.200.55 policyid=1 interface="port12" user="bob" group="N/A"
authproto="TELNET(10.1.100.11)" action="authentication" status="success" reason="N/A"
msg="User bob succeeded in authentication"

The following is an example of a user subtype log sent in CEF format to a syslog server:
Dec 27 11:17:35 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|43008|event:user authentication
success|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0102043008 cat=event:user
FTNTFGTsubtype=user FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938255
FTNTFGTlogdesc=Authentication success src=10.1.100.11 dst=172.16.200.55
FTNTFGTpolicyid=1 deviceInboundInterface=port12 duser=bob FTNTFGTgroup=N/A
FTNTFGTauthproto=TELNET(10.1.100.11) act=authentication outcome=success reason=N/A
msg=User bob succeeded in authentication

Antivirus log support for CEF

The following is an example of an antivirus log on the FortiGate disk:

date=2018-12-27 time=11:20:49 logid="0211008192" type="utm" subtype="virus"
eventtype="infected" level="warning" vd="vdom1" eventtime=1545938448 msg="File is

FortiOS 6.0.10 Log Reference 47

Fortinet, Inc.
CEF Support

infected." action="blocked" service="HTTP" sessionid=695 srcip=10.1.100.11

dstip=172.16.200.55 srcport=44356 dstport=80 srcintf="port12" srcintfrole="undefined"
dstintf="port11" dstintfrole="undefined" policyid=1 proto=6 direction="incoming"
filename="eicar.com" quarskip="File-was-not-quarantined." virus="EICAR_TEST_FILE"
dtype="Virus" ref="http://www.fortinet.com/ve?vn=EICAR_TEST_FILE" virusid=2172
url="http://172.16.200.55/virus/eicar.com" profile="g-default" user="bob"
agent="curl/7.47.0"
analyticscksum="275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
analyticssubmit="false" crscore=50 crlevel="critical"

The following is an example of an antivirus log sent in CEF format to a syslog server:
Dec 27 11:20:48 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|08192|utm:virus infected
blocked|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0211008192 cat=utm:virus
FTNTFGTsubtype=virus FTNTFGTeventtype=infected FTNTFGTlevel=warning FTNTFGTvd=vdom1
FTNTFGTeventtime=1545938448 msg=File is infected. act=blocked app=HTTP externalId=695
src=10.1.100.11 dst=172.16.200.55 spt=44356 dpt=80 deviceInboundInterface=port12
FTNTFGTsrcintfrole=undefined deviceOutboundInterface=port11
FTNTFGTdstintfrole=undefined FTNTFGTpolicyid=1 proto=6 deviceDirection=0
fname=eicar.com FTNTFGTquarskip=File-was-not-quarantined. FTNTFGTvirus=EICAR_TEST_FILE
FTNTFGTdtype=Virus FTNTFGTref=http://www.fortinet.com/ve?vn\=EICAR_TEST_FILE
FTNTFGTvirusid=2172 request=http://172.16.200.55/virus/eicar.com FTNTFGTprofile=g-
default duser=bob requestClientApplication=curl/7.47.0
FTNTFGTanalyticscksum=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
FTNTFGTanalyticssubmit=false FTNTFGTcrscore=50 FTNTFGTcrlevel=critical

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

direction deviceDirection (inbound/outbound mapping to 0/1)

filename fname

ref FTNTFGTref (There is \ added to escape = )

url request

agent requestClientApplication

Webfilter log support for CEF

The following is an example of a webfilter log on the FortiGate disk:

date=2018-12-27 time=11:23:50 logid="0316013056" type="utm" subtype="webfilter"
eventtype="ftgd_blk" level="warning" vd="vdom1" eventtime=1545938629 policyid=1
sessionid=764 user="bob" srcip=10.1.100.11 srcport=59194 srcintf="port12"
srcintfrole="undefined" dstip=185.230.61.185 dstport=80 dstintf="port11"
dstintfrole="undefined" proto=6 service="HTTP" hostname="ambrishsriv.wixsite.com"
profile="g-default" action="blocked" reqtype="direct" url="/bizsquads" sentbyte=96
rcvdbyte=0 direction="outgoing" msg="URL belongs to a denied category in policy"
method="domain" cat=26 catdesc="Malicious Websites" crscore=60 crlevel="high"

The following is an example of a webfilter log sent in CEF format to a syslog server:
Dec 27 11:23:49 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|13056|utm:webfilter ftgd_blk
blocked|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0316013056 cat=utm:webfilter
FTNTFGTsubtype=webfilter FTNTFGTeventtype=ftgd_blk FTNTFGTlevel=warning
FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938629 FTNTFGTpolicyid=1 externalId=764 duser=bob
src=10.1.100.11 spt=59194 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined
dst=185.230.61.185 dpt=80 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined

FortiOS 6.0.10 Log Reference 48

Fortinet, Inc.
CEF Support

proto=6 app=HTTP dhost=ambrishsriv.wixsite.com FTNTFGTprofile=g-default act=blocked

FTNTFGTreqtype=direct request=/bizsquads out=96 in=0 deviceDirection=1 msg=URL belongs
to a denied category in policy FTNTFGTmethod=domain FTNTFGTcat=26
requestContext=Malicious Websites FTNTFGTcrscore=60 FTNTFGTcrlevel=high

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

hostname dhost

catdesc requestContext

IPS log support for CEF

The following is an example of an IPS log on the FortiGate disk:

date=2018-12-27 time=11:28:07 logid="0419016384" type="utm" subtype="ips"
eventtype="signature" level="alert" vd="vdom1" eventtime=1545938887 severity="info"
srcip=172.16.200.55 srccountry="Reserved" dstip=10.1.100.11 srcintf="port11"
srcintfrole="undefined" dstintf="port12" dstintfrole="undefined" sessionid=901
action="reset" proto=6 service="HTTP" policyid=1 attack="Eicar.Virus.Test.File"
srcport=80 dstport=44362 hostname="172.16.200.55" url="/virus/eicar.com"
direction="incoming" attackid=29844 profile="test-ips"
ref="http://www.fortinet.com/ids/VID29844" user="bob" incidentserialno=877326946
msg="file_transfer: Eicar.Virus.Test.File,"

The following is an example of an IPS sent in CEF format to a syslog server:

Dec 27 11:28:07 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|16384|utm:ips signature
reset|7|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0419016384 cat=utm:ips
FTNTFGTsubtype=ips FTNTFGTeventtype=signature FTNTFGTlevel=alert FTNTFGTvd=vdom1
FTNTFGTeventtime=1545938887 FTNTFGTseverity=info src=172.16.200.55
FTNTFGTsrccountry=Reserved dst=10.1.100.11 deviceInboundInterface=port11
FTNTFGTsrcintfrole=undefined deviceOutboundInterface=port12
FTNTFGTdstintfrole=undefined externalId=901 act=reset proto=6 app=HTTP
FTNTFGTpolicyid=1 FTNTFGTattack=Eicar.Virus.Test.File spt=80 dpt=44362
dhost=172.16.200.55 request=/virus/eicar.com deviceDirection=0 FTNTFGTattackid=29844
FTNTFGTprofile=test-ips FTNTFGTref=http://www.fortinet.com/ids/VID29844 duser=bob
FTNTFGTincidentserialno=877326946 msg=file_transfer: Eicar.Virus.Test.File,

Email Spamfilter log support for CEF

The following is an example of an email spamfilter log on the FortiGate disk:

date=2018-12-27 time=11:36:58 logid="0508020503" type="utm" subtype="emailfilter"
eventtype="smtp" level="information" vd="vdom1" eventtime=1545939418 policyid=1
sessionid=1135 user="bob" srcip=10.1.100.11 srcport=35969 srcintf="port12"
srcintfrole="undefined" dstip=172.18.62.158 dstport=25 dstintf="port11"
dstintfrole="undefined" proto=6 service="SMTP" profile="test-spam" action="log-only"
from="[email protected]" to="[email protected]"
sender="[email protected]" recipient="[email protected]"
direction="outgoing" msg="general email log" subject="hello_world2" size="216"
attachment="no"

The following is an example of an email spamfilter log sent in CEF format to a syslog server:
Dec 27 11:36:58 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|20503|utm:emailfilter smtp log-
only|2|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0508020503 cat=utm:emailfilter

FortiOS 6.0.10 Log Reference 49

Fortinet, Inc.
CEF Support

FTNTFGTsubtype=emailfilter FTNTFGTeventtype=smtp FTNTFGTlevel=information

FTNTFGTvd=vdom1 FTNTFGTeventtime=1545939418 FTNTFGTpolicyid=1 externalId=1135
duser=bob src=10.1.100.11 spt=35969 deviceInboundInterface=port12
FTNTFGTsrcintfrole=undefined dst=172.18.62.158 dpt=25 deviceOutboundInterface=port11
FTNTFGTdstintfrole=undefined proto=6 app=SMTP FTNTFGTprofile=test-spam act=log-only
[email protected] [email protected]
[email protected] [email protected]
deviceDirection=1 msg=general email log FTNTFGTsubject=hello_world2 FTNTFGTsize=216
FTNTFGTattachment=no

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

from suser

to duser

Anomaly log support for CEF

The following is an example of an anomaly log on the FortiGate disk:

date=2018-12-27 time=11:40:04 logid="0720018433" type="utm" subtype="anomaly"
eventtype="anomaly" level="alert" vd="vdom1" eventtime=1545939604 severity="critical"
srcip=10.1.100.11 srccountry="Reserved" dstip=172.16.200.55 srcintf="port12"
srcintfrole="undefined" sessionid=0 action="clear_session" proto=1 service="PING"
count=1 attack="icmp_flood" icmpid="0x3053" icmptype="0x08" icmpcode="0x00"
attackid=16777316 policyid=1 policytype="DoS-policy"
ref="http://www.fortinet.com/ids/VID16777316" msg="anomaly: icmp_flood, 51 > threshold
50" crscore=50 crlevel="critical"

The following is an example of an anomaly log sent in CEF format to a syslog server:
Dec 27 11:40:04 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|18433|utm:anomaly anomaly clear_
session|7|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0720018433 cat=utm:anomaly
FTNTFGTsubtype=anomaly FTNTFGTeventtype=anomaly FTNTFGTlevel=alert FTNTFGTvd=vdom1
FTNTFGTeventtime=1545939604 FTNTFGTseverity=critical src=10.1.100.11
FTNTFGTsrccountry=Reserved dst=172.16.200.55 deviceInboundInterface=port12
FTNTFGTsrcintfrole=undefined externalId=0 act=clear_session proto=1 app=PING cnt=1
FTNTFGTattack=icmp_flood FTNTFGTicmpid=0x3053 FTNTFGTicmptype=0x08
FTNTFGTicmpcode=0x00 FTNTFGTattackid=16777316 FTNTFGTpolicyid=1 FTNTFGTpolicytype=DoS-
policy FTNTFGTref=http://www.fortinet.com/ids/VID16777316 msg=anomaly: icmp_flood, 51
> threshold 50 FTNTFGTcrscore=50 FTNTFGTcrlevel=critical

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

count cnt

VoIP log support for CEF

The following is an example of an VoIP log on the FortiGate disk:

date=2018-12-27 time=16:47:09 logid="0814044032" type="utm" subtype="voip" eventtype="voip"
level="information" vd="vdom1" eventtime=1545958028 session_id=18975 epoch=0 event_
id=6857 srcip=10.1.100.11 src_port=5060 dstip=172.16.200.55 dst_port=5060 proto=17
src_int="port12" dst_int="port11" policy_id=1 profile="default" voip_proto="sip"

FortiOS 6.0.10 Log Reference 50

Fortinet, Inc.
CEF Support

kind="call" action="permit" status="start" duration=0 dir="session_origin" call_

id="[email protected]" from="sip:[email protected]:5060"
to="sip:[email protected]:5060"

The following is an example of an VoIP sent in CEF format to a syslog server:

Dec 27 16:47:08 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|44032|utm:voip voip permit
start|2|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0814044032 cat=utm:voip
FTNTFGTsubtype=voip FTNTFGTeventtype=voip FTNTFGTlevel=information FTNTFGTvd=vdom1
FTNTFGTeventtime=1545958028 externalId=18975 FTNTFGTepoch=0 FTNTFGTevent_id=6857
src=10.1.100.11 spt=5060 dst=172.16.200.55 dpt=5060 proto=17
deviceInboundInterface=port12 deviceOutboundInterface=port11 FTNTFGTpolicy_id=1
FTNTFGTprofile=default FTNTFGTvoip_proto=sip FTNTFGTkind=call act=permit outcome=start
FTNTFGTduration=0 FTNTFGTdir=session_origin [email protected]
suser=sip:[email protected]:5060 duser=sip:[email protected]:5060

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

status outcome

from suser

to duser

DLP log support for CEF

The following is an example of a DLP log on the FortiGate disk:

date=2018-12-27 time=14:29:36 logid="0954024576" type="utm" subtype="dlp" eventtype="dlp"
level="warning" vd="vdom1" eventtime=1545949776 filteridx=1 dlpextra="test-dlp3"
filtertype="file-type" filtercat="file" severity="medium" policyid=1 sessionid=12680
epoch=418303178 eventid=0 user="bob" srcip=10.1.100.11 srcport=33638 srcintf="port12"
srcintfrole="undefined" dstip=172.18.62.158 dstport=80 dstintf="port11"
dstintfrole="undefined" proto=6 service="HTTP" filetype="gif" direction="incoming"
action="block" hostname="172.18.62.158" url="/dlp/flower.gif" agent="curl/7.47.0"
filename="flower.gif" filesize=1209 profile="test-dlp"

The following is an example of a DLP log sent in CEF format to a syslog server:

Dec 27 14:29:36 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|24576|utm:dlp dlp
block|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0954024576 cat=utm:dlp
FTNTFGTsubtype=dlp FTNTFGTeventtype=dlp FTNTFGTlevel=warning FTNTFGTvd=vdom1
FTNTFGTeventtime=1545949776 FTNTFGTfilteridx=1 FTNTFGTdlpextra=test-dlp3
FTNTFGTfiltertype=file-type FTNTFGTfiltercat=file FTNTFGTseverity=medium
FTNTFGTpolicyid=1 externalId=12680 FTNTFGTepoch=418303178 FTNTFGTeventid=0 duser=bob
src=10.1.100.11 spt=33638 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined
dst=172.18.62.158 dpt=80 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined
proto=6 app=HTTP FTNTFGTfiletype=gif deviceDirection=0 act=block dhost=172.18.62.158
request=/dlp/flower.gif requestClientApplication=curl/7.47.0 fname=flower.gif
fsize=1209 FTNTFGTprofile=test-dlp

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name CEF Field Name

filename fname

FortiOS 6.0.10 Log Reference 51

Fortinet, Inc.
CEF Support

Application log support for CEF

The following is an example of an application log on the FortiGate disk:

date=2018-12-27 time=14:28:08 logid="1059028704" type="utm" subtype="app-ctrl"
eventtype="app-ctrl-all" level="information" vd="vdom1" eventtime=1545949688
appid=34050 srcip=10.1.100.11 dstip=104.80.89.24 srcport=56826 dstport=80
srcintf="port12" srcintfrole="undefined" dstintf="port11" dstintfrole="undefined"
proto=6 service="HTTP" direction="outgoing" policyid=1 sessionid=12567 applist="g-
default" appcat="Web.Client" app="HTTP.BROWSER_Firefox" action="pass"
hostname="detectportal.firefox.com" incidentserialno=1702350499 url="/success.txt"
msg="Web.Client: HTTP.BROWSER_Firefox," apprisk="elevated"

The following is an example of an application sent in CEF format to a syslog server:

Dec 27 14:28:08 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|28704|utm:app-ctrl app-ctrl-all
pass|2|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1059028704 cat=utm:app-ctrl
FTNTFGTsubtype=app-ctrl FTNTFGTeventtype=app-ctrl-all FTNTFGTlevel=information
FTNTFGTvd=vdom1 FTNTFGTeventtime=1545949688 FTNTFGTappid=34050 src=10.1.100.11
dst=104.80.89.24 spt=56826 dpt=80 deviceInboundInterface=port12
FTNTFGTsrcintfrole=undefined deviceOutboundInterface=port11
FTNTFGTdstintfrole=undefined proto=6 app=HTTP deviceDirection=1 FTNTFGTpolicyid=1
externalId=12567 FTNTFGTapplist=g-default FTNTFGTappcat=Web.Client
FTNTFGTapp=HTTP.BROWSER_Firefox act=pass dhost=detectportal.firefox.com
FTNTFGTincidentserialno=1702350499 request=/success.txt msg=Web.Client: HTTP.BROWSER_
Firefox, FTNTFGTapprisk=elevated

WAF log support for CEF

The following is an example of an WAF log on the FortiGate disk:

date=2018-12-27 time=14:55:20 logid="1203030258" type="utm" subtype="waf" eventtype="waf-
http-constraint" level="warning" vd="vdom1" eventtime=1545951320 policyid=1
sessionid=13614 user="bob" profile="waf_test" srcip=10.1.100.11 srcport=57304
dstip=172.16.200.55 dstport=80 srcintf="port12" srcintfrole="lan" dstintf="port11"
dstintfrole="wan" proto=6 service="HTTP"
url="http://172.16.200.55/index.html?a=0123456789&b=0123456789&c=0123456789"
severity="medium" action="passthrough" direction="request" agent="curl/7.47.0"
constraint="url-param-num" rawdata="Method=GET|User-Agent=curl/7.47.0"

The following is an example of an WAF sent in CEF format to a syslog server:

Dec 27 14:55:20 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|30258|utm:waf waf-http-constraint
passthrough|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1203030258 cat=utm:waf
FTNTFGTsubtype=waf FTNTFGTeventtype=waf-http-constraint FTNTFGTlevel=warning
FTNTFGTvd=vdom1 FTNTFGTeventtime=1545951320 FTNTFGTpolicyid=1 externalId=13614
duser=bob FTNTFGTprofile=waf_test src=10.1.100.11 spt=57304 dst=172.16.200.55 dpt=80
deviceInboundInterface=port12 FTNTFGTsrcintfrole=lan deviceOutboundInterface=port11
FTNTFGTdstintfrole=wan proto=6 app=HTTP
request=http://172.16.200.55/index.html?a\=0123456789&b\=0123456789&c\=0123456789
FTNTFGTseverity=medium act=passthrough deviceDirection=0
requestClientApplication=curl/7.47.0 FTNTFGTconstraint=url-param-num
FTNTFGTrawdata=Method\=GET|User-Agent\=curl/7.47.0

DNS log support for CEF

The following is an example of an DNS log on the FortiGate disk:

FortiOS 6.0.10 Log Reference 52

Fortinet, Inc.
CEF Support

date=2018-12-27 time=14:45:26 logid="1501054802" type="dns" subtype="dns-response"

level="notice" vd="vdom1" eventtime=1545950726 policyid=1 sessionid=13355 user="bob"
srcip=10.1.100.11 srcport=54621 srcintf="port12" srcintfrole="lan" dstip=172.16.200.55
dstport=53 dstintf="port11" dstintfrole="wan" proto=17 profile="default"
srcmac="a2:e9:00:ec:40:01" xid=5137 qname="detectportal.firefox.com" qtype="A"
qtypeval=1 qclass="IN" ipaddr="104.80.89.26, 104.80.89.24" msg="Domain is monitored"
action="pass" cat=52 catdesc="Information Technology"

The following is an example of an DNS sent in CEF format to a syslog server:

Dec 27 14:45:26 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|54802|dns:dns-response
pass|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1501054802 cat=dns:dns-response
FTNTFGTsubtype=dns-response FTNTFGTlevel=notice FTNTFGTvd=vdom1
FTNTFGTeventtime=1545950726 FTNTFGTpolicyid=1 externalId=13355 duser=bob
src=10.1.100.11 spt=54621 deviceInboundInterface=port12 FTNTFGTsrcintfrole=lan
dst=172.16.200.55 dpt=53 deviceOutboundInterface=port11 FTNTFGTdstintfrole=wan
proto=17 FTNTFGTprofile=default FTNTFGTsrcmac=a2:e9:00:ec:40:01 FTNTFGTxid=5137
FTNTFGTqname=detectportal.firefox.com FTNTFGTqtype=A FTNTFGTqtypeval=1
FTNTFGTqclass=IN FTNTFGTipaddr=104.80.89.26, 104.80.89.24 msg=Domain is monitored
act=pass FTNTFGTcat=52 FTNTFGTcatdesc=Information Technology

SSH log support for CEF

The following is an example of an SSH log on the FortiGate disk:

date=2018-12-27 time=14:36:15 logid="1600061002" type="utm" subtype="ssh" eventtype="ssh-
command" level="notice" vd="vdom1" eventtime=1545950175 policyid=1 sessionid=12921
user="bob" profile="test-ssh" srcip=10.1.100.11 srcport=56698 dstip=172.16.200.55
dstport=22 srcintf="port12" srcintfrole="lan" dstintf="port11" dstintfrole="wan"
proto=6 action="passthrough" direction="outgoing" login="root" command="ls"
severity="low"

The following is an example of an SSH sent in CEF format to a syslog server:

Dec 27 14:36:15 FGT-A-LOG CEF: 0|Fortinet|Fortigate|v6.0.3|61002|utm:ssh ssh-command
passthrough|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1600061002 cat=utm:ssh
FTNTFGTsubtype=ssh FTNTFGTeventtype=ssh-command FTNTFGTlevel=notice FTNTFGTvd=vdom1
FTNTFGTeventtime=1545950175 FTNTFGTpolicyid=1 externalId=12921 duser=bob
FTNTFGTprofile=test-ssh src=10.1.100.11 spt=56698 dst=172.16.200.55 dpt=22
deviceInboundInterface=port12 FTNTFGTsrcintfrole=lan deviceOutboundInterface=port11
FTNTFGTdstintfrole=wan proto=6 act=passthrough FTNTFGTlogin=root FTNTFGTcommand=ls
FTNTFGTseverity=low

FortiOS 6.0.10 Log Reference 53

Fortinet, Inc.
UTM Extended Logging

UTM Extended Logging

FortiOS 6.0.0 and later supports extended logging for UTM log types to reliable Syslog servers over TCP. Extended
logging adds HTTP header information to the rawdata field in UTM log types. You must enable extended logging
before you can use the feature.
When extended logging is enabled, the following HTTP header information can be added to the rawdata field in
UTM logs:
l Method
l X-Forwarded-For
l Request-Content-Type | Response-Content-Type
l Referer
l User-Agent
The full rawdata field of 20KB is only sent to reliable Syslog servers. Other logging devices, such as disk, FortiAnalyzer,
and UDP Syslog servers, receive the information, but only keep a maximum of 2KB total log length, including the
rawdata field, and discard the rest of the extended log information.

Enabling extended logging

You can enable extended logging for the following UTM profiles:

l antivirus
l application
l dlp
l ips
l waf
l webfilter
When you enable the extended-log option for UTM profiles, all HTTP header information for HTTP-deny traffic is
logged.
When you enable the web-extended-all-action-log-enable option for webfilter profile, all HTTP header
information for HTTP-allow traffic is logged.

Extended logging option in UTM profiles

The extended-log option has been added to all UTM profiles, for example:
# webfilter profile
config webfilter profile
edit "test-webfilter"
set extended-log enable
set web-extended-all-action-log enable
next
end
# av profile

FortiOS 6.0.10 Log Reference 54

Fortinet, Inc.
UTM Extended Logging

config antivirus profile

edit "av-proxy-test"
set extended-log enable
next
end
# waf profile
config waf profile
edit "test-waf"
set extended-log enable
next
end

Syslog server mode

The Syslog server mode changed to udp, reliable, and legacy-reliable. You must set the mode to
reliable to support extended logging, for example:
config log syslogd setting
set status enable
set server "<ip address>"
set mode reliable
set facility local6
end

Example of an extended log

Following is an example extended log for a utm log type with a webfilter subtype for a reliable Syslog server. The
rawdata field contains the extended log data.
Dec 18 15:40:15 10.6.30.254 date=2017-12-18 time=15:40:14 devname="600D-9"
devid="FGT6HD3915800120" logid="0316013056" type="utm"subtype="webfilter"
eventtype="ftgd_blk" level="warning" vd="vdom1" eventtime=1513640414 policyid=2
sessionid=440522 srcip=10.1.100.128 srcport=60995 srcintf="port2" srcintfrole="lan"
dstip=209.121.139.177 dstport=80 dstintf="port1" dstintfrole="wan" proto=6
service="HTTP" hostname="detectportal.firefox.com" profile="test-webfilter"
action="blocked" reqtype="direct" url="/success.txt" sentbyte=285 rcvdbyte=0
direction="outgoing" msg="URL belongs to a denied category in policy" method="domain"
cat=52 catdesc="Information Technology" crscore=30 crlevel="high"
rawdata="Method=GET|User-Agent=Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101
Firefox/57.0"

FortiOS 6.0.10 Log Reference 55

Fortinet, Inc.
Log Messages

Log Messages

The following sections list the FortiOS 6.0.10 log messages by log ID number.

Anomaly

18432 - LOGID_ATTCK_ANOMALY_TCP_UDP

Message ID: 18432

Message Description: LOGID_ATTCK_ANOMALY_TCP_UDP
Message Meaning: Attack detected by UCP/TCP anomaly
Type: Anomaly
Category: ANOMALY
Severity: Alert

Log Field Name Description Data Type Length

action Action string 16

attack Attack string 256

attackid Attack ID uint32 10

count Count uint32 10

craction Client Reputation Action uint32 10

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

FortiOS 6.0.10 Log Reference 56

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logid Log ID string 10

msg Log Message string 518

policyid Policy ID uint32 10

policytype string 24

proto Protocol uint8 3

ref Reference string

service Name of Service string 36

sessionid Session ID uint32 10

severity Severity string 8

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User string 256

vd Virtual Domain Name string 32

vrf uint8 3

18433 - LOGID_ATTCK_ANOMALY_ICMP

Message ID: 18433

Message Description: LOGID_ATTCK_ANOMALY_ICMP
Message Meaning: Attack detected by ICMP anomaly
Type: Anomaly
Category: ANOMALY
Severity: Alert

FortiOS 6.0.10 Log Reference 57

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 16

attack Attack string 256

attackid Attack ID uint32 10

count Count uint32 10

craction Client Reputation Action uint32 10

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

icmpcode ICMP code string 6

icmpid ICMP ID string 8

icmptype ICMP Type string 6

level Log Level string 11

logid Log ID string 10

msg Log Message string 518

policyid Policy ID uint32 10

policytype string 24

proto Protocol uint8 3

ref Reference string

service Name of Service string 36

sessionid Session ID uint32 10

severity Severity string 8

srcintf Source Interface string 64

FortiOS 6.0.10 Log Reference 58

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User string 256

vd Virtual Domain Name string 32

vrf uint8 3

18434 - LOGID_ATTCK_ANOMALY_OTHERS

Message ID: 18434

Message Description: LOGID_ATTCK_ANOMALY_OTHERS
Message Meaning: Attack detected by other anomaly
Type: Anomaly
Category: ANOMALY
Severity: Alert

Log Field Name Description Data Type Length

action Action string 16

attack Attack string 256

attackid Attack ID uint32 10

count Count uint32 10

craction Client Reputation Action uint32 10

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 64

dstintfrole string 10

FortiOS 6.0.10 Log Reference 59

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 518

policyid Policy ID uint32 10

policytype string 24

proto Protocol uint8 3

ref Reference string

service Name of Service string 36

sessionid Session ID uint32 10

severity Severity string 8

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User string 256

vd Virtual Domain Name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 60

Fortinet, Inc.
Log Messages

App

28672 - LOGID_APP_CTRL_IM_BASIC

Message ID: 28672

Message Description: LOGID_APP_CTRL_IM_BASIC
Message Meaning: Application control IM-basic
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

FortiOS 6.0.10 Log Reference 61

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28673 - LOGID_APP_CTRL_IM_BASIC_WITH_STATUS

Message ID: 28673

Message Description: LOGID_APP_CTRL_IM_BASIC_WITH_STATUS
Message Meaning: Application control IM
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

FortiOS 6.0.10 Log Reference 62

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28674 - LOGID_APP_CTRL_IM_BASIC_WITH_COUNT

Message ID: 28674

Message Description: LOGID_APP_CTRL_IM_BASIC_WITH_COUNT
Message Meaning: Application control IM (chat message count)
Type: App
Category: APP-CTRL-ALL
Severity: Information

FortiOS 6.0.10 Log Reference 63

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 64

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user string 256

vd string 32

vrf uint8 3

28675 - LOGID_APP_CTRL_IM_FILE

Message ID: 28675

Message Description: LOGID_APP_CTRL_IM_FILE
Message Meaning: Application control IM (file)
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

FortiOS 6.0.10 Log Reference 65

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28676 - LOGID_APP_CTRL_IM_CHAT

Message ID: 28676

Message Description: LOGID_APP_CTRL_IM_CHAT
Message Meaning: Application control IM (chat)
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

FortiOS 6.0.10 Log Reference 66

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28677 - LOGID_APP_CTRL_IM_CHAT_BLOCK

Message ID: 28677

Message Description: LOGID_APP_CTRL_IM_CHAT_BLOCK

FortiOS 6.0.10 Log Reference 67

Fortinet, Inc.
Log Messages

Message Meaning: Application control IM (chat blocked)

Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

FortiOS 6.0.10 Log Reference 68

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28678 - LOGID_APP_CTRL_IM_BLOCK

Message ID: 28678

Message Description: LOGID_APP_CTRL_IM_BLOCK
Message Meaning: Application control IM (blocked)
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

FortiOS 6.0.10 Log Reference 69

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28704 - LOGID_APP_CTRL_IPS_PASS

Message ID: 28704

Message Description: LOGID_APP_CTRL_IPS_PASS
Message Meaning: Application control (IPS) (pass)
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

FortiOS 6.0.10 Log Reference 70

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

appid uint32 10

applist string 64

apprisk string 16

ccertissuer string 64

cloudaction string 32

clouduser string 256

crlevel string 10

crscore uint32 10

date string 10

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

filesize uint64 10

forwardedfor string 128

group string 64

hostname string 256

incidentserialno uint32 10

level string 11

logid string 10

msg string 512

policyid uint32 10

profiletype string 36

proto uint8 3

scertcname string 64

scertissuer string 64

FortiOS 6.0.10 Log Reference 71

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

vrf uint8 3

28705 - LOGID_APP_CTRL_IPS_BLOCK

Message ID: 28705

Message Description: LOGID_APP_CTRL_IPS_BLOCK
Message Meaning: Application control (IPS) (block)
Type: App
Category: APP-CTRL-ALL
Severity: Warning

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

appid uint32 10

applist string 64

FortiOS 6.0.10 Log Reference 72

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

apprisk string 16

ccertissuer string 64

cloudaction string 32

clouduser string 256

crlevel string 10

crscore uint32 10

date string 10

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

filesize uint64 10

forwardedfor string 128

group string 64

hostname string 256

incidentserialno uint32 10

level string 11

logid string 10

msg string 512

policyid uint32 10

profiletype string 36

proto uint8 3

scertcname string 64

scertissuer string 64

service string 36

sessionid uint32 10

FortiOS 6.0.10 Log Reference 73

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

vrf uint8 3

28706 - LOGID_APP_CTRL_IPS_RESET

Message ID: 28706

Message Description: LOGID_APP_CTRL_IPS_RESET
Message Meaning: Application control (IPS) (reset)
Type: App
Category: APP-CTRL-ALL
Severity: Warning

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

appid uint32 10

applist string 64

apprisk string 16

ccertissuer string 64

FortiOS 6.0.10 Log Reference 74

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cloudaction string 32

clouduser string 256

crlevel string 10

crscore uint32 10

date string 10

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

filesize uint64 10

forwardedfor string 128

group string 64

hostname string 256

incidentserialno uint32 10

level string 11

logid string 10

msg string 512

policyid uint32 10

profiletype string 36

proto uint8 3

scertcname string 64

scertissuer string 64

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

FortiOS 6.0.10 Log Reference 75

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

vrf uint8 3

28720 - LOGID_APP_CTRL_SSH_PASS

Message ID: 28720

Message Description: LOGID_APP_CTRL_SSH_PASS
Message Meaning: Application control IM (SSH) (pass)
Type: App
Category: APP-CTRL-ALL
Severity: Information

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

FortiOS 6.0.10 Log Reference 76

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

vrf uint8 3

28721 - LOGID_APP_CTRL_SSH_BLOCK

Message ID: 28721

Message Description: LOGID_APP_CTRL_SSH_BLOCK
Message Meaning: Application control IM (SSH) (block)
Type: App
Category: APP-CTRL-ALL
Severity: Warning

FortiOS 6.0.10 Log Reference 77

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 16

app string 96

appcat string 64

applist string 64

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

policyid uint32 10

profiletype string 36

proto uint8 3

service string 36

sessionid uint32 10

srcintf string 64

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 78

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user string 256

vd string 32

vrf uint8 3

AV

8192 - MESGID_INFECT_WARNING

Message ID: 8192

Message Description: MESGID_INFECT_WARNING
Message Meaning: Infected file detected by the FortiGate unit and blocked
Type: AV
Category: INFECTED
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

FortiOS 6.0.10 Log Reference 79

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

filename File name string 256

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

FortiOS 6.0.10 Log Reference 80

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8193 - MESGID_INFECT_NOTIF

Message ID: 8193

Message Description: MESGID_INFECT_NOTIF
Message Meaning: Infected file detected by the FortiGate unit and it passed
Type: AV
Category: INFECTED
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

FortiOS 6.0.10 Log Reference 81

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

filename File name string 256

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

FortiOS 6.0.10 Log Reference 82

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8194 - MESGID_INFECT_MIME_WARNING

Message ID: 8194

Message Description: MESGID_INFECT_MIME_WARNING
Message Meaning: MIME header detected to have a virus and blocked
Type: AV
Category: INFECTED
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

FortiOS 6.0.10 Log Reference 83

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

FortiOS 6.0.10 Log Reference 84

Fortinet, Inc.
Log Messages

8195 - MESGID_INFECT_MIME_NOTIF

Message ID: 8195

Message Description: MESGID_INFECT_MIME_NOTIF
Message Meaning: MIME header infected and passed
Type: AV
Category: INFECTED
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

FortiOS 6.0.10 Log Reference 85

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8200 - MESGID_MIME_FILETYPE_EXE_WARNING

Message ID: 8200

Message Description: MESGID_MIME_FILETYPE_EXE_WARNING
Message Meaning: File is an executable (warning)
Type: AV

FortiOS 6.0.10 Log Reference 86

Fortinet, Inc.
Log Messages

Category: FILETYPE-EXECUTABLE
Severity: Warning

Log Field Name Description Data Type Length

action string 16

agent string 64

analyticscksum string 64

analyticssubmit string 10

checksum string 16

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

dtype string 32

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

forwardedfor string 128

from string 128

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

profile string 64

proto uint8 3

quarskip string 46

recipient string 512

FortiOS 6.0.10 Log Reference 87

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ref string 512

sender string 128

service string 5

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

to string 512

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

virus string 128

virusid uint32 10

vrf uint8 3

8201 - MESGID_MIME_FILETYPE_EXE_NOTIF

Message ID: 8201

Message Description: MESGID_MIME_FILETYPE_EXE_NOTIF
Message Meaning: File is an executable (notice)
Type: AV
Category: FILETYPE-EXECUTABLE
Severity: Notice

FortiOS 6.0.10 Log Reference 88

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 16

agent string 64

analyticscksum string 64

analyticssubmit string 10

checksum string 16

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

dtype string 32

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

forwardedfor string 128

from string 128

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

profile string 64

proto uint8 3

quarskip string 46

recipient string 512

ref string 512

FortiOS 6.0.10 Log Reference 89

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sender string 128

service string 5

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

to string 512

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

virus string 128

virusid uint32 10

vrf uint8 3

8448 - MESGID_BLOCK_WARNING

Message ID: 8448

Message Description: MESGID_BLOCK_WARNING
Message Meaning: FortiGate unit blocked a file because it contains a virus
Type: AV
Category: FILENAME
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

FortiOS 6.0.10 Log Reference 90

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

FortiOS 6.0.10 Log Reference 91

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8449 - MESGID_BLOCK_NOTIF

Message ID: 8449

Message Description: MESGID_BLOCK_NOTIF
Message Meaning: FortiGate unit blocked a file because it contains a virus
Type: AV
Category: FILENAME
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

FortiOS 6.0.10 Log Reference 92

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

FortiOS 6.0.10 Log Reference 93

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8450 - MESGID_BLOCK_MIME_WARNING

Message ID: 8450

Message Description: MESGID_BLOCK_MIME_WARNING
Message Meaning: FortiGate unit blocked a file because it contains a virus (MIME)
Type: AV
Category: MIMEFRAGMENTED
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

FortiOS 6.0.10 Log Reference 94

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 95

Fortinet, Inc.
Log Messages

8451 - MESGID_BLOCK_MIME_NOTIF

Message ID: 8451

Message Description: MESGID_BLOCK_MIME_NOTIF
Message Meaning: FortiGate unit blocked a file because it contains a virus (MIME)
Type: AV
Category: MIMEFRAGMENTED
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

FortiOS 6.0.10 Log Reference 96

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8452 - MESGID_BLOCK_COMMAND

Message ID: 8452

Message Description: MESGID_BLOCK_COMMAND
Message Meaning: FortiGate unit blocked a virus command
Type: AV
Category: COMMAND-BLOCKED
Severity: Warning

FortiOS 6.0.10 Log Reference 97

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 16

agent string 64

command string 16

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

profile string 64

proto uint8 3

service string 5

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

FortiOS 6.0.10 Log Reference 98

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

vrf uint8 3

8453 - MESGID_INTERCEPT

Message ID: 8453

Message Description: MESGID_INTERCEPT
Message Meaning: FortiGate unit intercepted a file containing a virus
Type: AV
Category: FILENAME
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

FortiOS 6.0.10 Log Reference 99

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 100

Fortinet, Inc.
Log Messages

8454 - MESGID_INTERCEPT_MIME

Message ID: 8454

Message Description: MESGID_INTERCEPT_MIME
Message Meaning: FortiGate unit intercepted a file (MIME)
Type: AV
Category: FILENAME
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

FortiOS 6.0.10 Log Reference 101

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8455 - MESGID_EXEMPT

Message ID: 8455

Message Description: MESGID_EXEMPT
Message Meaning: File exempted
Type: AV
Category: FILENAME
Severity: Notice

FortiOS 6.0.10 Log Reference 102

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 103

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8456 - MESGID_EXEMPT_MIME

Message ID: 8456

Message Description: MESGID_EXEMPT_MIME
Message Meaning: File exempted
Type: AV
Category: FILENAME
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

FortiOS 6.0.10 Log Reference 104

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filefilter The filter used to identify the affected file string 12

filename File name string 256

filetype File type string 16

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 105

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8457 - MESGID_MMS_CHECKSUM

Message ID: 8457

Message Description: MESGID_MMS_CHECKSUM
Message Meaning: MMS content checksum blocked an infected file
Type: AV
Category: FILENAME
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

FortiOS 6.0.10 Log Reference 106

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8458 - MESGID_MMS_CHECKSUM_NOTIF

Message ID: 8458

Message Description: MESGID_MMS_CHECKSUM_NOTIF

FortiOS 6.0.10 Log Reference 107

Fortinet, Inc.
Log Messages

Message Meaning: MMS content checksum was matched

Type: AV
Category: FILENAME
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 108

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8704 - MESGID_OVERSIZE_WARNING

Message ID: 8704

Message Description: MESGID_OVERSIZE_WARNING
Message Meaning: Defined file size limit was exceeded
Type: AV
Category: OVERSIZE
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

FortiOS 6.0.10 Log Reference 109

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

FortiOS 6.0.10 Log Reference 110

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8705 - MESGID_OVERSIZE_NOTIF

Message ID: 8705

Message Description: MESGID_OVERSIZE_NOTIF
Message Meaning: File size limit was exceeded
Type: AV
Category: OVERSIZE
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

FortiOS 6.0.10 Log Reference 111

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8706 - MESGID_OVERSIZE_MIME_WARNING

Message ID: 8706

Message Description: MESGID_OVERSIZE_MIME_WARNING
Message Meaning: File (MIME) size exceed the defined size limit
Type: AV
Category: OVERSIZE
Severity: Warning

FortiOS 6.0.10 Log Reference 112

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

FortiOS 6.0.10 Log Reference 113

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8707 - MESGID_OVERSIZE_MIME_NOTIF

Message ID: 8707

Message Description: MESGID_OVERSIZE_MIME_NOTIF
Message Meaning: File (MIME) size exceed the defined size limit
Type: AV
Category: OVERSIZE
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 114

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 115

Fortinet, Inc.
Log Messages

8720 - MESGID_SWITCH_PROTO_WARNING

Message ID: 8720

Message Description: MESGID_SWITCH_PROTO_WARNING
Message Meaning: Switching protocols request (warning)
Type: AV
Category: SWITCHPROTO
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 116

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

switchproto Protocol change information string 128

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

vrf uint8 3

8721 - MESGID_SWITCH_PROTO_NOTIF

Message ID: 8721

Message Description: MESGID_SWITCH_PROTO_NOTIF
Message Meaning: Switching protocols request (notice)
Type: AV
Category: SWITCHPROTO
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

FortiOS 6.0.10 Log Reference 117

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

switchproto Protocol change information string 128

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

FortiOS 6.0.10 Log Reference 118

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd VDOM name string 32

vrf uint8 3

8960 - MESGID_SCAN_UNCOMPSIZELIMIT_WARNING

Message ID: 8960

Message Description: MESGID_SCAN_UNCOMPSIZELIMIT_WARNING
Message Meaning: File reached the uncompressed nested limit
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

FortiOS 6.0.10 Log Reference 119

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

FortiOS 6.0.10 Log Reference 120

Fortinet, Inc.
Log Messages

8961 - MESGID_SCAN_UNCOMPSIZELIMIT_NOTIF

Message ID: 8961

Message Description: MESGID_SCAN_UNCOMPSIZELIMIT_NOTIF
Message Meaning: File reached the uncompressed size limit
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

FortiOS 6.0.10 Log Reference 121

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8962 - MESGID_SCAN_ARCHIVE_ENCRYPTED_WARNING

Message ID: 8962

Message Description: MESGID_SCAN_ARCHIVE_ENCRYPTED_WARNING
Message Meaning: Archived file is corrupted
Type: AV

FortiOS 6.0.10 Log Reference 122

Fortinet, Inc.
Log Messages

Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

FortiOS 6.0.10 Log Reference 123

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8963 - MESGID_SCAN_ARCHIVE_ENCRYPTED_NOTIF

Message ID: 8963

Message Description: MESGID_SCAN_ARCHIVE_ENCRYPTED_NOTIF
Message Meaning: Archived file is encrypted
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

FortiOS 6.0.10 Log Reference 124

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 125

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8964 - MESGID_SCAN_ARCHIVE_CORRUPTED_WARNING

Message ID: 8964

Message Description: MESGID_SCAN_ARCHIVE_CORRUPTED_WARNING
Message Meaning: Corrupted archive (warning)
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

FortiOS 6.0.10 Log Reference 126

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

FortiOS 6.0.10 Log Reference 127

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8965 - MESGID_SCAN_ARCHIVE_CORRUPTED_NOTIF

Message ID: 8965

Message Description: MESGID_SCAN_ARCHIVE_CORRUPTED_NOTIF
Message Meaning: Corrupted archive (notice)
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

FortiOS 6.0.10 Log Reference 128

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

FortiOS 6.0.10 Log Reference 129

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8966 - MESGID_SCAN_ARCHIVE_MULTIPART_WARNING

Message ID: 8966

Message Description: MESGID_SCAN_ARCHIVE_MULTIPART_WARNING
Message Meaning: File is a multipart archive or contains multiple files within the archive
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 130

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 131

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8967 - MESGID_SCAN_ARCHIVE_MULTIPART_NOTIF

Message ID: 8967

Message Description: MESGID_SCAN_ARCHIVE_MULTIPART_NOTIF
Message Meaning: File is a multipart archive or contains multiple files within the archive
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

FortiOS 6.0.10 Log Reference 132

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

FortiOS 6.0.10 Log Reference 133

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8968 - MESGID_SCAN_ARCHIVE_NESTED_WARNING

Message ID: 8968

Message Description: MESGID_SCAN_ARCHIVE_NESTED_WARNING
Message Meaning: File is a nested archived file
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

FortiOS 6.0.10 Log Reference 134

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

FortiOS 6.0.10 Log Reference 135

Fortinet, Inc.
Log Messages

8969 - MESGID_SCAN_ARCHIVE_NESTED_NOTIF

Message ID: 8969

Message Description: MESGID_SCAN_ARCHIVE_NESTED_NOTIF
Message Meaning: File is an archived type unhandled
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

FortiOS 6.0.10 Log Reference 136

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8970 - MESGID_SCAN_ARCHIVE_OVERSIZE_WARNING

Message ID: 8970

Message Description: MESGID_SCAN_ARCHIVE_OVERSIZE_WARNING
Message Meaning: Archived file is oversized
Type: AV

FortiOS 6.0.10 Log Reference 137

Fortinet, Inc.
Log Messages

Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

FortiOS 6.0.10 Log Reference 138

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8971 - MESGID_SCAN_ARCHIVE_OVERSIZE_NOTIF

Message ID: 8971

Message Description: MESGID_SCAN_ARCHIVE_OVERSIZE_NOTIF
Message Meaning: Archived file is oversized
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

FortiOS 6.0.10 Log Reference 139

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 140

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8972 - MESGID_SCAN_ARCHIVE_UNHANDLED_WARNING

Message ID: 8972

Message Description: MESGID_SCAN_ARCHIVE_UNHANDLED_WARNING
Message Meaning: Unhandled archive (warning)
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

FortiOS 6.0.10 Log Reference 141

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

FortiOS 6.0.10 Log Reference 142

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8973 - MESGID_SCAN_ARCHIVE_UNHANDLED_NOTIF

Message ID: 8973

Message Description: MESGID_SCAN_ARCHIVE_UNHANDLED_NOTIF
Message Meaning: Unhandled archive (notice)
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

FortiOS 6.0.10 Log Reference 143

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

FortiOS 6.0.10 Log Reference 144

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8974 - MESGID_SCAN_AV_ENGINE_LOAD_FAILED_ERROR

Message ID: 8974

Message Description: MESGID_SCAN_AV_ENGINE_LOAD_FAILED_ERROR
Message Meaning: AV Engine load failed
Type: AV
Category: SCANERROR
Severity: Error

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 145

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 146

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8975 - MESGID_SCAN_ARCHIVE_PARTIALLYCORRUPTED_WARNING

Message ID: 8975

Message Description: MESGID_SCAN_ARCHIVE_PARTIALLYCORRUPTED_WARNING
Message Meaning: Partially corrupted archive (warning)
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

FortiOS 6.0.10 Log Reference 147

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

FortiOS 6.0.10 Log Reference 148

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8976 - MESGID_SCAN_ARCHIVE_PARTIALLYCORRUPTED_NOTIF

Message ID: 8976

Message Description: MESGID_SCAN_ARCHIVE_PARTIALLYCORRUPTED_NOTIF
Message Meaning: Partially corrupted archive (notice)
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

FortiOS 6.0.10 Log Reference 149

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

FortiOS 6.0.10 Log Reference 150

Fortinet, Inc.
Log Messages

8977 - MESGID_SCAN_ARCHIVE_FILESLIMIT_WARNING

Message ID: 8977

Message Description: MESGID_SCAN_ARCHIVE_FILESLIMIT_WARNING
Message Meaning: Exceeded archive files limit (warning)
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

FortiOS 6.0.10 Log Reference 151

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8978 - MESGID_SCAN_ARCHIVE_FILESLIMIT_NOTIF

Message ID: 8978

Message Description: MESGID_SCAN_ARCHIVE_FILESLIMIT_NOTIF
Message Meaning: Exceeded archive files limit (notice)
Type: AV
Category: SCANERROR

FortiOS 6.0.10 Log Reference 152

Fortinet, Inc.
Log Messages

Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

FortiOS 6.0.10 Log Reference 153

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8979 - MESGID_SCAN_ARCHIVE_TIMEOUT_WARNING

Message ID: 8979

Message Description: MESGID_SCAN_ARCHIVE_TIMEOUT_WARNING
Message Meaning: Archive scan timeout (warning)
Type: AV
Category: SCANERROR
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

FortiOS 6.0.10 Log Reference 154

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

FortiOS 6.0.10 Log Reference 155

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

8980 - MESGID_SCAN_ARCHIVE_TIMEOUT_NOTIF

Message ID: 8980

Message Description: MESGID_SCAN_ARCHIVE_TIMEOUT_NOTIF
Message Meaning: Archive scan timeout (notice)
Type: AV
Category: SCANERROR
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

FortiOS 6.0.10 Log Reference 156

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 157

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

9233 - MESGID_ANALYTICS_SUBMITTED

Message ID: 9233

Message Description: MESGID_ANALYTICS_SUBMITTED
Message Meaning: File submitted to Sandbox
Type: AV
Category: ANALYTICS
Severity: Information

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

contentdisarmed string 13

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 158

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

filetype string 16

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 159

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

9234 - MESGID_ANALYTICS_INFECT_WARNING

Message ID: 9234

Message Description: MESGID_ANALYTICS_INFECT_WARNING
Message Meaning: File reported infected by FortiSandbox (warning)
Type: AV
Category: INFECTED
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 160

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

FortiOS 6.0.10 Log Reference 161

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

9235 - MESGID_ANALYTICS_INFECT_NOTIF

Message ID: 9235

Message Description: MESGID_ANALYTICS_INFECT_NOTIF
Message Meaning: File reported infected by FortiSandbox (notice)
Type: AV
Category: INFECTED
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

FortiOS 6.0.10 Log Reference 162

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

FortiOS 6.0.10 Log Reference 163

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

9236 - MESGID_ANALYTICS_INFECT_MIME_WARNING

Message ID: 9236

Message Description: MESGID_ANALYTICS_INFECT_MIME_WARNING
Message Meaning: File reported infected by FortiSandbox (warning)
Type: AV
Category: INFECTED
Severity: Warning

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 164

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 165

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

9237 - MESGID_ANALYTICS_INFECT_MIME_NOTIF

Message ID: 9237

Message Description: MESGID_ANALYTICS_INFECT_MIME_NOTIF
Message Meaning: File reported infected by FortiSandbox (notice)
Type: AV
Category: INFECTED
Severity: Notice

Log Field Name Description Data Type Length

action The security action performed by AV string 16

agent User agent - eg. agent="Mozilla/5.0" string 64

analyticscksum The checksum of the file submitted for analytics string 64

analyticssubmit The flag for analytics submission string 10

checksum The checksum of the scanned file string 16

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Message/packets direction string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

FortiOS 6.0.10 Log Reference 166

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group Group name (authentication) string 64

level Log level string 11

logid Log ID string 10

msg Log message string

policyid Policy ID uint32 10

profile The name of the profile that was used to detect and take action string 64

proto Protocol number uint8 3

quarskip Quarantine skip explanation string 46

recipient Email addresses from the SMTP envelope string 512

ref The URL of the FortiGuard IPS database entry for the attack string 512

sender Email address from the SMTP envelope string 128

service Proxy service which scanned this traffic string 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 167

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

url The url address string 512

user Username (authentication) string 256

vd VDOM name string 32

virus Virus Name string 128

virusid Virus ID (unique virus identifier) uint32 10

vrf uint8 3

9238 - MESGID_ANALYTICS_FSA_RESULT

Message ID: 9238

Message Description: MESGID_ANALYTICS_FSA_RESULT
Message Meaning: File verdict returned from FortiSandbox
Type: AV
Category: ANALYTICS
Severity: Notice

Log Field Name Description Data Type Length

analyticscksum The checksum of the file submitted for analytics string 64

date Date string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

dtype Data type for virus category string 32

eventtime uint64 20

eventtype Event type of AV string 32

fctuid string 32

filename File name string 256

fsaverdict string 32

level Log level string 11

logid Log ID string 10

msg Log message string

service Proxy service which scanned this traffic string 5

srcip Source IP Address ip 39

FortiOS 6.0.10 Log Reference 168

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype subtype of the virus log string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The url address string 512

vd VDOM name string 32

9239 - MESGID_CONTENT_DISARM_NOTIF

Message ID: 9239

Message Description: MESGID_CONTENT_DISARM_NOTIF
Message Meaning: Active content detected by Content Disarm engine
Type: AV
Category: CONTENT-DISARM
Severity: Notice

Log Field Name Description Data Type Length

action string 16

agent string 64

analyticscksum string 64

contentdisarmed string 13

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 169

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype string 32

fctuid string 32

filename string 256

forwardedfor string 128

from string 128

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

profile string 64

proto uint8 3

recipient string 512

sender string 128

service string 5

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

to string 512

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

FortiOS 6.0.10 Log Reference 170

Fortinet, Inc.
Log Messages

9240 - MESGID_CONTENT_DISARM_WARNING

Message ID: 9240

Message Description: MESGID_CONTENT_DISARM_WARNING
Message Meaning: File was disarmed by Content Disarm engine
Type: AV
Category: CONTENT-DISARM
Severity: Warning

Log Field Name Description Data Type Length

action string 16

agent string 64

analyticscksum string 64

contentdisarmed string 13

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

forwardedfor string 128

from string 128

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

FortiOS 6.0.10 Log Reference 171

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile string 64

proto uint8 3

recipient string 512

sender string 128

service string 5

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

to string 512

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

9248 - MESGID_BOTNET_WARNING

Message ID: 9248

Message Description: MESGID_BOTNET_WARNING
Message Meaning: Botnet C&C Communication (warning)
Type: AV
Category: BOTNET
Severity: Warning

Log Field Name Description Data Type Length

action string 16

FortiOS 6.0.10 Log Reference 172

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

agent string 64

analyticscksum string 64

analyticssubmit string 10

checksum string 16

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

dtype string 32

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

from string 128

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

profile string 64

proto uint8 3

quarskip string 46

recipient string 512

ref string 512

sender string 128

service string 5

FortiOS 6.0.10 Log Reference 173

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

to string 512

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

virus string 128

virusid uint32 10

vrf uint8 3

9249 - MESGID_BOTNET_NOTIF

Message ID: 9249

Message Description: MESGID_BOTNET_NOTIF
Message Meaning: Botnet C&C Communication (notice)
Type: AV
Category: BOTNET
Severity: Notice

Log Field Name Description Data Type Length

action string 16

agent string 64

analyticscksum string 64

analyticssubmit string 10

FortiOS 6.0.10 Log Reference 174

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

checksum string 16

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

dtype string 32

eventtime uint64 20

eventtype string 32

fctuid string 32

filename string 256

from string 128

group string 64

level string 11

logid string 10

msg string

policyid uint32 10

profile string 64

proto uint8 3

quarskip string 46

recipient string 512

ref string 512

sender string 128

service string 5

sessionid uint32 10

srcintf string 32

srcintfrole string 10

FortiOS 6.0.10 Log Reference 175

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

to string 512

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

user string 256

vd string 32

virus string 128

virusid uint32 10

vrf uint8 3

DLP

24576 - LOG_ID_DLP_WARN

Message ID: 24576

Message Description: LOG_ID_DLP_WARN
Message Meaning: Data leak detected by specified DLP sensor rule
Type: DLP
Category: DLP
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by DLP string 20

agent User agent - eg. agent="Mozilla/5.0" string 64

date Date string 10

direction Direction of packets string 8

dlpextra DLP extra information string 256

FortiOS 6.0.10 Log Reference 176

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

epoch Epoch used for locating file uint32 10

eventid The serial number of the dlparchive file in the same epoch uint32 10

eventtime uint64 20

eventtype DLP event type string 32

fctuid string 32

filename File name string 256

filesize File size in bytes uint64 10

filetype File type string 23

filtercat DLP filter category string 8

filteridx DLP filter ID uint32 10

filtername DLP rule name string 128

filtertype DLP filter type string 23

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group User group name string 64

hostname The host name of a URL string 256

infectedfilelevel uint32 10

infectedfilename string 256

infectedfilesize uint64 10

infectedfiletype string 23

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile DLP profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

FortiOS 6.0.10 Log Reference 177

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

severity Severity level of a DLP rule string 8

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 128

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

24577 - LOG_ID_DLP_NOTIF

Message ID: 24577

Message Description: LOG_ID_DLP_NOTIF
Message Meaning: Data leak detected by specified DLP sensor rule
Type: DLP
Category: DLP
Severity: Notice

FortiOS 6.0.10 Log Reference 178

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by DLP string 20

agent User agent - eg. agent="Mozilla/5.0" string 64

date Date string 10

direction Direction of packets string 8

dlpextra DLP extra information string 256

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

epoch Epoch used for locating file uint32 10

eventid The serial number of the dlparchive file in the same epoch uint32 10

eventtime uint64 20

eventtype DLP event type string 32

fctuid string 32

filename File name string 256

filesize File size in bytes uint64 10

filetype File type string 23

filtercat DLP filter category string 8

filteridx DLP filter ID uint32 10

filtername DLP rule name string 128

filtertype DLP filter type string 23

forwardedfor string 128

from Email address from the Email Headers (IMAP/POP3/SMTP) string 128

group User group name string 64

hostname The host name of a URL string 256

infectedfilelevel uint32 10

infectedfilename string 256

infectedfilesize uint64 10

infectedfiletype string 23

level Log Level string 11

FortiOS 6.0.10 Log Reference 179

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

policyid Policy ID uint32 10

profile DLP profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email address from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

severity Severity level of a DLP rule string 8

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 128

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

24578 - LOG_ID_DLP_DOC_SOURCE

Message ID: 24578

Message Description: LOG_ID_DLP_DOC_SOURCE

FortiOS 6.0.10 Log Reference 180

Fortinet, Inc.
Log Messages

Message Meaning: DLP fingerprint document source notice

Type: DLP
Category: DLP
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

dlpextra DLP extra information string 256

docsource DLP fingerprint document source string 515

eventtime uint64 20

eventtype DLP event type string 32

fctuid string 32

level Log Level string 11

logid Log ID string 10

sensitivity Sensitivity for document fingerprint string 36

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

vd Virtual domain name string 32

24579 - LOG_ID_DLP_DOC_SOURCE_ERROR

Message ID: 24579

Message Description: LOG_ID_DLP_DOC_SOURCE_ERROR
Message Meaning: DLP fingerprint document source error
Type: DLP
Category: DLP
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

dlpextra DLP extra information string 256

FortiOS 6.0.10 Log Reference 181

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

docsource DLP fingerprint document source string 515

eventtime uint64 20

eventtype DLP event type string 32

fctuid string 32

level Log Level string 11

logid Log ID string 10

sensitivity Sensitivity for document fingerprint string 36

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

vd Virtual domain name string 32

DNS

54000 - LOG_ID_DNS_QUERY

Message ID: 54000

Message Description: LOG_ID_DNS_QUERY
Message Meaning: DNS query message
Type: DNS
Category: DNS-QUERY
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 182

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54200 - LOG_ID_DNS_RESOLV_ERROR

Message ID: 54200

Message Description: LOG_ID_DNS_RESOLV_ERROR
Message Meaning: DNS resolution error message
Type: DNS
Category: DNS-RESPONSE

FortiOS 6.0.10 Log Reference 183

Fortinet, Inc.
Log Messages

Severity: Error

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

error DNS filter error message string 256

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 184

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54400 - LOG_ID_DNS_URL_FILTER_BLOCK

Message ID: 54400

Message Description: LOG_ID_DNS_URL_FILTER_BLOCK
Message Meaning: Domain blocked because it is in the domain-filter list
Type: DNS
Category: DNS-RESPONSE
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

date Date string 10

domainfilteridx Domain filter ID uint8 3

domainfilterlist Domain filter name string 512

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

exchange Mail Exchanges from DNS response answer section string 256

fctuid string 32

group User group name string 64

ipaddr IP addresses from DNS response answer section string 512

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

FortiOS 6.0.10 Log Reference 185

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54401 - LOG_ID_DNS_URL_FILTER_ALLOW

Message ID: 54401

Message Description: LOG_ID_DNS_URL_FILTER_ALLOW
Message Meaning: Domain allowed because it is in the domain-filter list
Type: DNS
Category: DNS-RESPONSE
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

FortiOS 6.0.10 Log Reference 186

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

domainfilteridx Domain filter ID uint8 3

domainfilterlist Domain filter name string 512

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

exchange Mail Exchanges from DNS response answer section string 256

fctuid string 32

group User group name string 64

ipaddr IP addresses from DNS response answer section string 512

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 187

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54600 - LOG_ID_DNS_BOTNET_IP

Message ID: 54600

Message Description: LOG_ID_DNS_BOTNET_IP
Message Meaning: Domain blocked by DNS botnet C&C (IP)
Type: DNS
Category: DNS-RESPONSE
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

botnetdomain Botnet domain name string 256

botnetip Botnet IP address ip 39

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

exchange Mail Exchanges from DNS response answer section string 256

fctuid string 32

group User group name string 64

ipaddr IP addresses from DNS response answer section string 512

level Log Level string 11

logid Log ID string 10

FortiOS 6.0.10 Log Reference 188

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54601 - LOG_ID_DNS_BOTNET_DOMAIN

Message ID: 54601

Message Description: LOG_ID_DNS_BOTNET_DOMAIN
Message Meaning: Domain blocked by DNS botnet C&C (Domain)
Type: DNS
Category: DNS-RESPONSE
Severity: Warning

FortiOS 6.0.10 Log Reference 189

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

botnetdomain Botnet domain name string 256

botnetip Botnet IP address ip 39

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 190

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54800 - LOG_ID_DNS_FTGD_WARNING

Message ID: 54800

Message Description: LOG_ID_DNS_FTGD_WARNING
Message Meaning: FortiGuard rating error warning
Type: DNS
Category: DNS-RESPONSE
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

cat DNS category ID uint8 3

catdesc DNS category description string 64

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

error DNS filter error message string 256

eventtime uint64 20

exchange Mail Exchanges from DNS response answer section string 256

fctuid string 32

group User group name string 64

ipaddr IP addresses from DNS response answer section string 512

level Log Level string 11

logid Log ID string 10

FortiOS 6.0.10 Log Reference 191

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54801 - LOG_ID_DNS_FTGD_ERROR

Message ID: 54801

Message Description: LOG_ID_DNS_FTGD_ERROR
Message Meaning: FortiGuard rating error occurred
Type: DNS
Category: DNS-RESPONSE
Severity: Error

FortiOS 6.0.10 Log Reference 192

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

error DNS filter error message string 256

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 193

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54802 - LOG_ID_DNS_FTGD_CAT_ALLOW

Message ID: 54802

Message Description: LOG_ID_DNS_FTGD_CAT_ALLOW
Message Meaning: Domain is monitored
Type: DNS
Category: DNS-RESPONSE
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

cat DNS category ID uint8 3

catdesc DNS category description string 64

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

exchange Mail Exchanges from DNS response answer section string 256

fctuid string 32

group User group name string 64

ipaddr IP addresses from DNS response answer section string 512

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

FortiOS 6.0.10 Log Reference 194

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

54803 - LOG_ID_DNS_FTGD_CAT_BLOCK

Message ID: 54803

Message Description: LOG_ID_DNS_FTGD_CAT_BLOCK
Message Meaning: Domain belongs to a denied category in policy
Type: DNS
Category: DNS-RESPONSE
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by DNS filter string 16

FortiOS 6.0.10 Log Reference 195

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cat DNS category ID uint8 3

catdesc DNS category description string 64

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

exchange Mail Exchanges from DNS response answer section string 256

fctuid string 32

group User group name string 64

ipaddr IP addresses from DNS response answer section string 512

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Profile name for DNS filter string 64

proto Protocol number uint8 3

qclass Query class string 32

qname Query domain name string 256

qtype Query type description string 32

qtypeval uint16 5

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcmac MAC address associated with the Source IP string 17

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 196

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual Domain Name string 32

xid Transaction ID uint16 5

Email

20480 - LOGID_ANTISPAM_EMAIL_SMTP_NOTIF

Message ID: 20480

Message Description: LOGID_ANTISPAM_EMAIL_SMTP_NOTIF
Message Meaning: SMTP warning
Type: Email
Category: SMTP
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 197

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 198

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20481 - LOGID_ANTISPAM_EMAIL_SMTP_BWORD_NOTIF

Message ID: 20481

Message Description: LOGID_ANTISPAM_EMAIL_SMTP_BWORD_NOTIF
Message Meaning: SMTP warning
Type: Email
Category: SMTP
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

FortiOS 6.0.10 Log Reference 199

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20482 - LOGID_ANTISPAM_EMAIL_POP3_NOTIF

Message ID: 20482

Message Description: LOGID_ANTISPAM_EMAIL_POP3_NOTIF

FortiOS 6.0.10 Log Reference 200

Fortinet, Inc.
Log Messages

Message Meaning: POP3 warning

Type: Email
Category: POP3
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

FortiOS 6.0.10 Log Reference 201

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20483 - LOGID_ANTISPAM_EMAIL_POP3_BWORD_NOTIF

Message ID: 20483

Message Description: LOGID_ANTISPAM_EMAIL_POP3_BWORD_NOTIF
Message Meaning: POP3 notice
Type: Email
Category: POP3
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

FortiOS 6.0.10 Log Reference 202

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

FortiOS 6.0.10 Log Reference 203

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20484 - LOGID_ANTISPAM_EMAIL_IMAP_NOTIF

Message ID: 20484

Message Description: LOGID_ANTISPAM_EMAIL_IMAP_NOTIF
Message Meaning: IMAP notice
Type: Email
Category: IMAP
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

FortiOS 6.0.10 Log Reference 204

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 205

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20485 - LOGID_ANTISPAM_ENDPOINT_FILTER_WARNING

Message ID: 20485

Message Description: LOGID_ANTISPAM_ENDPOINT_FILTER_WARNING
Message Meaning: Endpoint filter warning
Type: Email
Category: CARRIER-ENDPOINT-FILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

FortiOS 6.0.10 Log Reference 206

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

FortiOS 6.0.10 Log Reference 207

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd Virtual domain name string 32

vrf uint8 3

20486 - LOGID_ANTISPAM_ENDPOINT_FILTER_NOTIF

Message ID: 20486

Message Description: LOGID_ANTISPAM_ENDPOINT_FILTER_NOTIF
Message Meaning: Endpoint filter notice
Type: Email
Category: CARRIER-ENDPOINT-FILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 208

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20487 - LOGID_ANTISPAM_ENDPOINT_MM7_WARNING

Message ID: 20487

Message Description: LOGID_ANTISPAM_ENDPOINT_MM7_WARNING
Message Meaning: MM7 warning

FortiOS 6.0.10 Log Reference 209

Fortinet, Inc.
Log Messages

Type: Email
Category: CARRIER-ENDPOINT-FILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

FortiOS 6.0.10 Log Reference 210

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20488 - LOGID_ANTISPAM_ENDPOINT_MM7_NOTIF

Message ID: 20488

Message Description: LOGID_ANTISPAM_ENDPOINT_MM7_NOTIF
Message Meaning: MM7 notice
Type: Email
Category: CARRIER-ENDPOINT-FILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

FortiOS 6.0.10 Log Reference 211

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

FortiOS 6.0.10 Log Reference 212

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20489 - LOGID_ANTISPAM_ENDPOINT_MM1_WARNING

Message ID: 20489

Message Description: LOGID_ANTISPAM_ENDPOINT_MM1_WARNING
Message Meaning: MM1 warning
Type: Email
Category: CARRIER-ENDPOINT-FILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

FortiOS 6.0.10 Log Reference 213

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 214

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20490 - LOGID_ANTISPAM_ENDPOINT_MM1_NOTIF

Message ID: 20490

Message Description: LOGID_ANTISPAM_ENDPOINT_MM1_NOTIF
Message Meaning: MM1 notice
Type: Email
Category: CARRIER-ENDPOINT-FILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

FortiOS 6.0.10 Log Reference 215

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 216

Fortinet, Inc.
Log Messages

20491 - LOGID_ANTISPAM_EMAIL_IMAP_BWORD_NOTIF

Message ID: 20491

Message Description: LOGID_ANTISPAM_EMAIL_IMAP_BWORD_NOTIF
Message Meaning: IMAP banned word notice
Type: Email
Category: IMAP
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

FortiOS 6.0.10 Log Reference 217

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20492 - LOGID_ANTISPAM_MM1_FLOOD_WARNING

Message ID: 20492

Message Description: LOGID_ANTISPAM_MM1_FLOOD_WARNING
Message Meaning: MM1 flood detection warning
Type: Email
Category: MASS-MMS
Severity: Warning

FortiOS 6.0.10 Log Reference 218

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 219

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20493 - LOGID_ANTISPAM_MM1_FLOOD_NOTIF

Message ID: 20493

Message Description: LOGID_ANTISPAM_MM1_FLOOD_NOTIF
Message Meaning: MM1 flood detection notice
Type: Email
Category: MASS-MMS
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 220

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

FortiOS 6.0.10 Log Reference 221

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20494 - LOGID_ANTISPAM_MM4_FLOOD_WARNING

Message ID: 20494

Message Description: LOGID_ANTISPAM_MM4_FLOOD_WARNING
Message Meaning: MM4 flood detection warning
Type: Email
Category: MASS-MMS
Severity: Warning

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 222

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 223

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20495 - LOGID_ANTISPAM_MM4_FLOOD_NOTIF

Message ID: 20495

Message Description: LOGID_ANTISPAM_MM4_FLOOD_NOTIF
Message Meaning: MM4 flood detection notice
Type: Email
Category: MASS-MMS
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 224

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20496 - LOGID_ANTISPAM_MM1_DUPE_WARNING

Message ID: 20496

FortiOS 6.0.10 Log Reference 225

Fortinet, Inc.
Log Messages

Message Description: LOGID_ANTISPAM_MM1_DUPE_WARNING

Message Meaning: MM1 duplicate detection warning
Type: Email
Category: MASS-MMS
Severity: Warning

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

FortiOS 6.0.10 Log Reference 226

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20497 - LOGID_ANTISPAM_MM1_DUPE_NOTIF

Message ID: 20497

Message Description: LOGID_ANTISPAM_MM1_DUPE_NOTIF
Message Meaning: MM1 duplicate detection notice
Type: Email
Category: MASS-MMS
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

FortiOS 6.0.10 Log Reference 227

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

FortiOS 6.0.10 Log Reference 228

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20498 - LOGID_ANTISPAM_MM4_DUPE_WARNING

Message ID: 20498

Message Description: LOGID_ANTISPAM_MM4_DUPE_WARNING
Message Meaning: MM4 duplicate detection warning
Type: Email
Category: MASS-MMS
Severity: Warning

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

FortiOS 6.0.10 Log Reference 229

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 230

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20499 - LOGID_ANTISPAM_MM4_DUPE_NOTIF

Message ID: 20499

Message Description: LOGID_ANTISPAM_MM4_DUPE_NOTIF
Message Meaning: MM4 duplicate detection notice
Type: Email
Category: MASS-MMS
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

FortiOS 6.0.10 Log Reference 231

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

FortiOS 6.0.10 Log Reference 232

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd Virtual domain name string 32

vrf uint8 3

20500 - LOGID_ANTISPAM_EMAIL_MSN_NOTIF

Message ID: 20500

Message Description: LOGID_ANTISPAM_EMAIL_MSN_NOTIF
Message Meaning: MSN Hotmail email message
Type: Email
Category: MSN-HOTMAIL
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 233

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20501 - LOGID_ANTISPAM_EMAIL_YAHOO_NOTIF

Message ID: 20501

Message Description: LOGID_ANTISPAM_EMAIL_YAHOO_NOTIF
Message Meaning: Yahoo! email message

FortiOS 6.0.10 Log Reference 234

Fortinet, Inc.
Log Messages

Type: Email
Category: YAHOO-MAIL
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

FortiOS 6.0.10 Log Reference 235

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20502 - LOGID_ANTISPAM_EMAIL_GOOGLE_NOTIF

Message ID: 20502

Message Description: LOGID_ANTISPAM_EMAIL_GOOGLE_NOTIF
Message Meaning: Gmail email message
Type: Email
Category: GMAIL
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

FortiOS 6.0.10 Log Reference 236

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

FortiOS 6.0.10 Log Reference 237

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20503 - LOGID_EMAIL_SMTP_GENERAL_NOTIF

Message ID: 20503

Message Description: LOGID_EMAIL_SMTP_GENERAL_NOTIF
Message Meaning: SMTP warning
Type: Email
Category: SMTP
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

FortiOS 6.0.10 Log Reference 238

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 239

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20504 - LOGID_EMAIL_POP3_GENERAL_NOTIF

Message ID: 20504

Message Description: LOGID_EMAIL_POP3_GENERAL_NOTIF
Message Meaning: POP3 warning
Type: Email
Category: POP3
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

FortiOS 6.0.10 Log Reference 240

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 241

Fortinet, Inc.
Log Messages

20505 - LOGID_EMAIL_IMAP_GENERAL_NOTIF

Message ID: 20505

Message Description: LOGID_EMAIL_IMAP_GENERAL_NOTIF
Message Meaning: IMAP notice
Type: Email
Category: IMAP
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

FortiOS 6.0.10 Log Reference 242

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20506 - LOGID_EMAIL_MAPI_GENERAL_NOTIF

Message ID: 20506

Message Description: LOGID_EMAIL_MAPI_GENERAL_NOTIF
Message Meaning: MAPI notice
Type: Email
Category: MAPI
Severity: Information

FortiOS 6.0.10 Log Reference 243

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 244

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20507 - LOGID_ANTISPAM_EMAIL_MAPI_BWORD_NOTIF

Message ID: 20507

Message Description: LOGID_ANTISPAM_EMAIL_MAPI_BWORD_NOTIF
Message Meaning: MAPI banned word notice
Type: Email
Category: MAPI
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 245

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

FortiOS 6.0.10 Log Reference 246

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20508 - LOGID_ANTISPAM_EMAIL_MAPI_NOTIF

Message ID: 20508

Message Description: LOGID_ANTISPAM_EMAIL_MAPI_NOTIF
Message Meaning: MAPI email message
Type: Email
Category: MAPI
Severity: Notice

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 247

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

FortiOS 6.0.10 Log Reference 248

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

20509 - LOGID_ANTISPAM_FTGD_ERR

Message ID: 20509

Message Description: LOGID_ANTISPAM_FTGD_ERR
Message Meaning: FortiGuard error message
Type: Email
Category: MAPI
Severity: Information

Log Field Name Description Data Type Length

action Security action of the email filter string 8

agent User agent - eg. agent="Mozilla/5.0" string 64

attachment The flag for email attachement string 3

banword Banned word string 128

cc Email address(es) from the Email Headers string

(IMAP/POP3/SMTP)

date Date string 10

direction Direction of packets string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Email Filter event type string 32

fctuid string 32

fortiguardresp string 512

from Email address(es) from the Email Headers string 128

(IMAP/POP3/SMTP)

FortiOS 6.0.10 Log Reference 249

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User group name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string 512

policyid Policy ID uint32 10

profile Email Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte uint64 20

recipient Email addresses from the SMTP envelope string 512

sender Email addresses from the SMTP envelope string 128

sentbyte uint64 20

service Service name string 36

sessionid Session ID uint32 10

size Email size in Bytes? string 16

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subject The subject title of the email message string 256

subtype Log subtype string 20

time Time string 8

to Email address(es) from the Email Headers string 512

(IMAP/POP3/SMTP)

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 250

Fortinet, Inc.
Log Messages

Event

20002 - LOG_ID_DOMAIN_UNRESOLVABLE

Message ID: 20002

Message Description: LOG_ID_DOMAIN_UNRESOLVABLE
Message Meaning: Domain name of alert email sender unresolvable
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20003 - LOG_ID_MAIL_SENT_FAIL

Message ID: 20003

Message Description: LOG_ID_MAIL_SENT_FAIL
Message Meaning: Alert email send status failed
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 251

Fortinet, Inc.
Log Messages

Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

count Count uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20004 - LOG_ID_POLICY_TOO_BIG

Message ID: 20004

Message Description: LOG_ID_POLICY_TOO_BIG
Message Meaning: Policy too big for installation
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 252

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20005 - LOG_ID_PPP_LINK_UP

Message ID: 20005

Message Description: LOG_ID_PPP_LINK_UP
Message Meaning: Modem PPP link up
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 253

Fortinet, Inc.
Log Messages

20006 - LOG_ID_PPP_LINK_DOWN

Message ID: 20006

Message Description: LOG_ID_PPP_LINK_DOWN
Message Meaning: Modem PPP link down
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20007 - LOG_ID_SOCKET_EXHAUSTED

Message ID: 20007

Message Description: LOG_ID_SOCKET_EXHAUSTED
Message Meaning: NAT port exhausted
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

FortiOS 6.0.10 Log Reference 254

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

nat NAT IP Address ip 39

proto Protocol Number uint8 3

service Name of Service string 64

srcip Source IP ip 39

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vrf uint8 3

20008 - LOG_ID_POLICY6_TOO_BIG

Message ID: 20008

Message Description: LOG_ID_POLICY6_TOO_BIG
Message Meaning: IPv6 policy too big for installation
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 255

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20010 - LOG_ID_KERNEL_ERROR

Message ID: 20010

Message Description: LOG_ID_KERNEL_ERROR
Message Meaning: Kernel error
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 256

Fortinet, Inc.
Log Messages

20016 - LOG_ID_MODEM_EXCEED_REDIAL_COUNT

Message ID: 20016

Message Description: LOG_ID_MODEM_EXCEED_REDIAL_COUNT
Message Meaning: Modem exceeded redial limit
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20017 - LOG_ID_MODEM_FAIL_TO_OPEN

Message ID: 20017

Message Description: LOG_ID_MODEM_FAIL_TO_OPEN
Message Meaning: Modem failed to open
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 257

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20020 - LOG_ID_MODEM_USB_DETECTED

Message ID: 20020

Message Description: LOG_ID_MODEM_USB_DETECTED
Message Meaning: USB modem detected
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20021 - LOG_ID_MAIL_RESENT

Message ID: 20021

FortiOS 6.0.10 Log Reference 258

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_MAIL_RESENT

Message Meaning: Alert email resent
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

count Count uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20022 - LOG_ID_MODEM_USB_REMOVED

Message ID: 20022

Message Description: LOG_ID_MODEM_USB_REMOVED
Message Meaning: USB modem removed
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 259

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20023 - LOG_ID_MODEM_USBLTE_DETECTED

Message ID: 20023

Message Description: LOG_ID_MODEM_USBLTE_DETECTED
Message Meaning: USB LTE modem detected
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 260

Fortinet, Inc.
Log Messages

20024 - LOG_ID_MODEM_USBLTE_REMOVED

Message ID: 20024

Message Description: LOG_ID_MODEM_USBLTE_REMOVED
Message Meaning: USB LTE modem removed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20025 - LOG_ID_REPORTD_REPORT_SUCCESS

Message ID: 20025

Message Description: LOG_ID_REPORTD_REPORT_SUCCESS
Message Meaning: Report generated successfully
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

datarange data range for reports string 50

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 261

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

file File Name for Generated Report? string 256

filesize Report File Size in Bytes uint32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

processtime process time for reports uint32

reporttype Report Type string 20

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20026 - LOG_ID_REPORTD_REPORT_FAILURE

Message ID: 20026

Message Description: LOG_ID_REPORTD_REPORT_FAILURE
Message Meaning: Report generation failed
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 262

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20027 - LOG_ID_REPORT_DEL_OLD_REC

Message ID: 20027

Message Description: LOG_ID_REPORT_DEL_OLD_REC
Message Meaning: Outdated report files deleted
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20028 - LOG_ID_REPORT_RECREATE_DB

Message ID: 20028

Message Description: LOG_ID_REPORT_RECREATE_DB
Message Meaning: Report database recreated
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 263

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20031 - LOG_ID_RAD_OUT_OF_MEM

Message ID: 20031

Message Description: LOG_ID_RAD_OUT_OF_MEM
Message Meaning: RADVD out of memory
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 264

Fortinet, Inc.
Log Messages

20032 - LOG_ID_RAD_NOT_FOUND

Message ID: 20032

Message Description: LOG_ID_RAD_NOT_FOUND
Message Meaning: RADVD interface not found
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20033 - LOG_ID_RAD_MOBILE_IPV6

Message ID: 20033

Message Description: LOG_ID_RAD_MOBILE_IPV6
Message Meaning: RADVD mobile IPv6 extensions used
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 265

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20034 - LOG_ID_RAD_IPV6_OUT_OF_RANGE

Message ID: 20034

Message Description: LOG_ID_RAD_IPV6_OUT_OF_RANGE
Message Meaning: RADVD mobile IPv6 MinRtrAdvInterval out of range
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20035 - LOG_ID_RAD_MIN_OUT_OF_RANGE

Message ID: 20035

FortiOS 6.0.10 Log Reference 266

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_RAD_MIN_OUT_OF_RANGE

Message Meaning: RADVD MinRtrAdvInterval out of range
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20036 - LOG_ID_RAD_MAX_OUT_OF_RANGE

Message ID: 20036

Message Description: LOG_ID_RAD_MAX_OUT_OF_RANGE
Message Meaning: RADVD mobile IPv6 MaxRtrAdvInterval out of range
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 267

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20037 - LOG_ID_RAD_MAX_ADV_OUT_OF_RANGE

Message ID: 20037

Message Description: LOG_ID_RAD_MAX_ADV_OUT_OF_RANGE
Message Meaning: RADVD MaxRtrAdvInterval out of range
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20039 - LOG_ID_RAD_MTU_TOO_SMALL

Message ID: 20039

Message Description: LOG_ID_RAD_MTU_TOO_SMALL
Message Meaning: RADVD AdvLinkMTU too small

FortiOS 6.0.10 Log Reference 268

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20040 - LOG_ID_RAD_TIME_TOO_SMALL

Message ID: 20040

Message Description: LOG_ID_RAD_TIME_TOO_SMALL
Message Meaning: RADVD AdvReachableTime too small
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 269

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20041 - LOG_ID_RAD_HOP_OUT_OF_RANGE

Message ID: 20041

Message Description: LOG_ID_RAD_HOP_OUT_OF_RANGE
Message Meaning: RADVD AdvCurHopLimit too big
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20042 - LOG_ID_RAD_DFT_HOP_OUT_OF_RANGE

Message ID: 20042

Message Description: LOG_ID_RAD_DFT_HOP_OUT_OF_RANGE
Message Meaning: RADVD AdvCurHopLimit out of range
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 270

Fortinet, Inc.
Log Messages

Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20043 - LOG_ID_RAD_AGENT_OUT_OF_RANGE

Message ID: 20043

Message Description: LOG_ID_RAD_AGENT_OUT_OF_RANGE
Message Meaning: RADVD HomeAgentLifetime out of range
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 271

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

20044 - LOG_ID_RAD_AGENT_FLAG_NOT_SET

Message ID: 20044

Message Description: LOG_ID_RAD_AGENT_FLAG_NOT_SET
Message Meaning: RADVD AdvHomeAgentFlag not set
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20045 - LOG_ID_RAD_PREFIX_TOO_LONG

Message ID: 20045

Message Description: LOG_ID_RAD_PREFIX_TOO_LONG
Message Meaning: RADVD invalid prefix length
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 272

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20046 - LOG_ID_RAD_PREF_TIME_TOO_SMALL

Message ID: 20046

Message Description: LOG_ID_RAD_PREF_TIME_TOO_SMALL
Message Meaning: RADVD AdvValidLifetime less than AdvPreferredLifetime
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 273

Fortinet, Inc.
Log Messages

20047 - LOG_ID_RAD_FAIL_IPV6_SOCKET

Message ID: 20047

Message Description: LOG_ID_RAD_FAIL_IPV6_SOCKET
Message Meaning: RADVD failed to create an IPv6 socket
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20048 - LOG_ID_RAD_FAIL_OPT_IPV6_PKTINFO

Message ID: 20048

Message Description: LOG_ID_RAD_FAIL_OPT_IPV6_PKTINFO
Message Meaning: RADVD failed to set IPv6 packet info
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 274

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20049 - LOG_ID_RAD_FAIL_OPT_IPV6_CHECKSUM

Message ID: 20049

Message Description: LOG_ID_RAD_FAIL_OPT_IPV6_CHECKSUM
Message Meaning: RADVD failed to set IPv6 checksum
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20050 - LOG_ID_RAD_FAIL_OPT_IPV6_UNICAST_HOPS

Message ID: 20050

FortiOS 6.0.10 Log Reference 275

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_RAD_FAIL_OPT_IPV6_UNICAST_HOPS

Message Meaning: RADVD failed to set IPv6 unicast hops
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20051 - LOG_ID_RAD_FAIL_OPT_IPV6_MULTICAST_HOPS

Message ID: 20051

Message Description: LOG_ID_RAD_FAIL_OPT_IPV6_MULTICAST_HOPS
Message Meaning: RADVD failed to set IPv6 multicast hops
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 276

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20052 - LOG_ID_RAD_FAIL_OPT_IPV6_HOPLIMIT

Message ID: 20052

Message Description: LOG_ID_RAD_FAIL_OPT_IPV6_HOPLIMIT
Message Meaning: RADVD failed to set IPv6 hop limit
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20053 - LOG_ID_RAD_FAIL_OPT_IPPROTO_ICMPV6

Message ID: 20053

Message Description: LOG_ID_RAD_FAIL_OPT_IPPROTO_ICMPV6
Message Meaning: RADVD failed to set ICMPv6 filter

FortiOS 6.0.10 Log Reference 277

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20054 - LOG_ID_RAD_EXIT_BY_SIGNAL

Message ID: 20054

Message Description: LOG_ID_RAD_EXIT_BY_SIGNAL
Message Meaning: RADVD exited due to received signal
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 278

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20055 - LOG_ID_RAD_FAIL_CMDB_QUERY

Message ID: 20055

Message Description: LOG_ID_RAD_FAIL_CMDB_QUERY
Message Meaning: RADVD interface query creation failed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20056 - LOG_ID_RAD_FAIL_CMDB_FOR_EACH

Message ID: 20056

Message Description: LOG_ID_RAD_FAIL_CMDB_FOR_EACH
Message Meaning: RADVD query error
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 279

Fortinet, Inc.
Log Messages

Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20057 - LOG_ID_RAD_FAIL_FIND_VIRT_INTF

Message ID: 20057

Message Description: LOG_ID_RAD_FAIL_FIND_VIRT_INTF
Message Meaning: RADVD virtual interface not found
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 280

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

20058 - LOG_ID_RAD_UNLOAD_INTF

Message ID: 20058

Message Description: LOG_ID_RAD_UNLOAD_INTF
Message Meaning: RADVD unloaded interface
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20059 - LOG_ID_RAD_NO_PKT_INFO

Message ID: 20059

Message Description: LOG_ID_RAD_NO_PKT_INFO
Message Meaning: RADVD received packet with no information
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 281

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20060 - LOG_ID_RAD_INV_ICMPV6_LEN

Message ID: 20060

Message Description: LOG_ID_RAD_INV_ICMPV6_LEN
Message Meaning: RADVD received ICMPv6 packet with invalid length
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 282

Fortinet, Inc.
Log Messages

20061 - LOG_ID_RAD_INV_ICMPV6_TYPE

Message ID: 20061

Message Description: LOG_ID_RAD_INV_ICMPV6_TYPE
Message Meaning: RADVD received unwanted ICMPv6 packet
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20062 - LOG_ID_RAD_INV_ICMPV6_RA_LEN

Message ID: 20062

Message Description: LOG_ID_RAD_INV_ICMPV6_RA_LEN
Message Meaning: RADVD received ICMPv6 RA packet with invalid length
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 283

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20063 - LOG_ID_RAD_ICMPV6_NO_SRC_ADDR

Message ID: 20063

Message Description: LOG_ID_RAD_ICMPV6_NO_SRC_ADDR
Message Meaning: RADVD received ICMPv6 RA packet with non-link local source address
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20064 - LOG_ID_RAD_INV_ICMPV6_RS_LEN

Message ID: 20064

FortiOS 6.0.10 Log Reference 284

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_RAD_INV_ICMPV6_RS_LEN

Message Meaning: RADVD received ICMPv6 RS packet with invalid length
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20065 - LOG_ID_RAD_INV_ICMPV6_CODE

Message ID: 20065

Message Description: LOG_ID_RAD_INV_ICMPV6_CODE
Message Meaning: RADVD received ICMPv6 RS/RA packet with invalid code
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 285

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20066 - LOG_ID_RAD_INV_ICMPV6_HOP

Message ID: 20066

Message Description: LOG_ID_RAD_INV_ICMPV6_HOP
Message Meaning: RADVD received ICMPv6 RS/RA packet with invalid hop limit
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20067 - LOG_ID_RAD_MISMATCH_HOP

Message ID: 20067

Message Description: LOG_ID_RAD_MISMATCH_HOP
Message Meaning: RADVD local AdvCurHopLimit disagrees with remote site

FortiOS 6.0.10 Log Reference 286

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20068 - LOG_ID_RAD_MISMATCH_MGR_FLAG

Message ID: 20068

Message Description: LOG_ID_RAD_MISMATCH_MGR_FLAG
Message Meaning: RADVD local AdvManagedFlag disagrees with remote site
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 287

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20069 - LOG_ID_RAD_MISMATCH_OTH_FLAG

Message ID: 20069

Message Description: LOG_ID_RAD_MISMATCH_OTH_FLAG
Message Meaning: RADVD local AdvOtherConfigFlag disagrees with remote site
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20070 - LOG_ID_RAD_MISMATCH_TIME

Message ID: 20070

Message Description: LOG_ID_RAD_MISMATCH_TIME
Message Meaning: RADVD local AdvReachableTime disagrees with remote site
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 288

Fortinet, Inc.
Log Messages

Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20071 - LOG_ID_RAD_MISMATCH_TIMER

Message ID: 20071

Message Description: LOG_ID_RAD_MISMATCH_TIMER
Message Meaning: RADVD local AdvRetransTimer disagrees with remote site
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 289

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

20072 - LOG_ID_RAD_EXTRA_DATA

Message ID: 20072

Message Description: LOG_ID_RAD_EXTRA_DATA
Message Meaning: RADVD extra data in RA packet found
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20073 - LOG_ID_RAD_NO_OPT_DATA

Message ID: 20073

Message Description: LOG_ID_RAD_NO_OPT_DATA
Message Meaning: RADVD RA packet option length zero
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 290

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20074 - LOG_ID_RAD_INV_OPT_LEN

Message ID: 20074

Message Description: LOG_ID_RAD_INV_OPT_LEN
Message Meaning: RADVD RA packet option length greater than total length
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 291

Fortinet, Inc.
Log Messages

20075 - LOG_ID_RAD_MISMATCH_MTU

Message ID: 20075

Message Description: LOG_ID_RAD_MISMATCH_MTU
Message Meaning: RADVD local AdvLinkMTU disagrees with remote site
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20077 - LOG_ID_RAD_MISMATCH_PREF_TIME

Message ID: 20077

Message Description: LOG_ID_RAD_MISMATCH_PREF_TIME
Message Meaning: Interface AdvPreferredLifetime on our interface does not agree with a remote site
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 292

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20078 - LOG_ID_RAD_INV_OPT

Message ID: 20078

Message Description: LOG_ID_RAD_INV_OPT
Message Meaning: RADVD found invalid option in RA packet from remote site
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20079 - LOG_ID_RAD_READY

Message ID: 20079

FortiOS 6.0.10 Log Reference 293

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_RAD_READY

Message Meaning: RADVD daemon started
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20080 - LOG_ID_RAD_FAIL_TO_RCV

Message ID: 20080

Message Description: LOG_ID_RAD_FAIL_TO_RCV
Message Meaning: RADVD receive message failed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 294

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20081 - LOG_ID_RAD_INV_HOP

Message ID: 20081

Message Description: LOG_ID_RAD_INV_HOP
Message Meaning: RADVD received invalid IPv6 hop limit
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20082 - LOG_ID_RAD_INV_PKTINFO

Message ID: 20082

Message Description: LOG_ID_RAD_INV_PKTINFO
Message Meaning: RADVD received invalid IPv6 packet info

FortiOS 6.0.10 Log Reference 295

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20083 - LOG_ID_RAD_FAIL_TO_CHECK

Message ID: 20083

Message Description: LOG_ID_RAD_FAIL_TO_CHECK
Message Meaning: RADVD all-routers membership check failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 296

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20084 - LOG_ID_RAD_FAIL_TO_SEND

Message ID: 20084

Message Description: LOG_ID_RAD_FAIL_TO_SEND
Message Meaning: RADVD send message failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20085 - LOG_ID_SESSION_CLASH

Message ID: 20085

Message Description: LOG_ID_SESSION_CLASH
Message Meaning: Session clashed
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 297

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

proto Protocol Number uint8 3

status Status string 23

subtype Log Subtype string 20

time Time string 8

trace_id string 32

type Log Type string 16

vd Virtual Domain Name string 32

20086 - LOG_ID_XH0_EVENT

Message ID: 20086

Message Description: LOG_ID_XH0_EVENT
Message Meaning: xh0 crashed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 298

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20090 - LOG_ID_INTF_LINK_STA_CHG

Message ID: 20090

Message Description: LOG_ID_INTF_LINK_STA_CHG
Message Meaning: Interface link status changed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

intf Interface string 16

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20099 - LOG_ID_INTF_STA_CHG

Message ID: 20099

Message Description: LOG_ID_INTF_STA_CHG

FortiOS 6.0.10 Log Reference 299

Fortinet, Inc.
Log Messages

Message Meaning: Interface status changed

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20100 - LOG_ID_WEB_CAT_UPDATED

Message ID: 20100

Message Description: LOG_ID_WEB_CAT_UPDATED
Message Meaning: FortiGuard web filter category list updated
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 300

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20101 - LOG_ID_WEB_LIC_EXPIRE

Message ID: 20101

Message Description: LOG_ID_WEB_LIC_EXPIRE
Message Meaning: FortiGuard web filter license expiring
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20102 - LOG_ID_SPAM_LIC_EXPIRE

Message ID: 20102

Message Description: LOG_ID_SPAM_LIC_EXPIRE

FortiOS 6.0.10 Log Reference 301

Fortinet, Inc.
Log Messages

Message Meaning: FortiGuard antispam license expiring

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20103 - LOG_ID_AV_LIC_EXPIRE

Message ID: 20103

Message Description: LOG_ID_AV_LIC_EXPIRE
Message Meaning: FortiGuard antivirus license expiring
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 302

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20104 - LOG_ID_IPS_LIC_EXPIRE

Message ID: 20104

Message Description: LOG_ID_IPS_LIC_EXPIRE
Message Meaning: FortiGuard IPS license expiring
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20105 - LOG_ID_LOG_UPLOAD_SKIP

Message ID: 20105

Message Description: LOG_ID_LOG_UPLOAD_SKIP
Message Meaning: Log upload to FortiCloud skipped
Type: Event

FortiOS 6.0.10 Log Reference 303

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

error Error Reason for Log Upload to Forticloud string 256

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

vd Virtual Domain Name string 32

20107 - LOG_ID_LOG_UPLOAD_ERR

Message ID: 20107

Message Description: LOG_ID_LOG_UPLOAD_ERR
Message Meaning: Log upload error
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

error Error Reason for Log Upload to Forticloud string 256

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 304

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

20108 - LOG_ID_LOG_UPLOAD_DONE

Message ID: 20108

Message Description: LOG_ID_LOG_UPLOAD_DONE
Message Meaning: Log upload completed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

FortiOS 6.0.10 Log Reference 305

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

20109 - LOG_ID_WEB_LIC_EXPIRED

Message ID: 20109

Message Description: LOG_ID_WEB_LIC_EXPIRED
Message Meaning: FortiGuard web filter license expired
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20113 - LOG_ID_IPSA_DOWNLOAD_FAIL

Message ID: 20113

Message Description: LOG_ID_IPSA_DOWNLOAD_FAIL
Message Meaning: IPSA database download failed
Type: Event

FortiOS 6.0.10 Log Reference 306

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20115 - LOG_ID_IPSA_STATUSUPD_FAIL

Message ID: 20115

Message Description: LOG_ID_IPSA_STATUSUPD_FAIL
Message Meaning: IPSA driver update failed
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 307

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

20116 - LOG_ID_SPAM_LIC_EXPIRED

Message ID: 20116

Message Description: LOG_ID_SPAM_LIC_EXPIRED
Message Meaning: FortiGuard antispam license expired
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20117 - LOG_ID_AV_LIC_EXPIRED

Message ID: 20117

Message Description: LOG_ID_AV_LIC_EXPIRED
Message Meaning: FortiGuard antivirus license expired
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 308

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20118 - LOG_ID_WEBF_STATUS_REACH

Message ID: 20118

Message Description: LOG_ID_WEBF_STATUS_REACH
Message Meaning: FortiGuard webfilter reachable
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 309

Fortinet, Inc.
Log Messages

20119 - LOG_ID_WEBF_STATUS_UNREACH

Message ID: 20119

Message Description: LOG_ID_WEBF_STATUS_UNREACH
Message Meaning: FortiGuard webfilter unreachable
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20200 - LOG_ID_FIPS_SELF_TEST

Message ID: 20200

Message Description: LOG_ID_FIPS_SELF_TEST
Message Meaning: FIPS CC self-test initiated
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 310

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20201 - LOG_ID_FIPS_SELF_ALL_TEST

Message ID: 20201

Message Description: LOG_ID_FIPS_SELF_ALL_TEST
Message Meaning: FIPS ALL CC self-tests initiated
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 311

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20202 - LOG_ID_DISK_FORMAT_ERROR

Message ID: 20202

Message Description: LOG_ID_DISK_FORMAT_ERROR
Message Meaning: Disk partitioning or formatting Error
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20203 - LOG_ID_DAEMON_SHUTDOWN

Message ID: 20203

Message Description: LOG_ID_DAEMON_SHUTDOWN
Message Meaning: Daemon shutdown
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 312

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

action Action string 32

daemon Daemon Name string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

pid Process ID uint32 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20204 - LOG_ID_DAEMON_START

Message ID: 20204

Message Description: LOG_ID_DAEMON_START
Message Meaning: Daemon started
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

daemon Daemon Name string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 313

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

pid Process ID uint32 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20205 - LOG_ID_DISK_FORMAT_REQ

Message ID: 20205

Message Description: LOG_ID_DISK_FORMAT_REQ
Message Meaning: Format disk requested
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 314

Fortinet, Inc.
Log Messages

20206 - LOG_ID_DISK_SCAN_REQ

Message ID: 20206

Message Description: LOG_ID_DISK_SCAN_REQ
Message Meaning: Scan disk requested
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20207 - LOG_ID_RAD_MISMATCH_VALID_TIME

Message ID: 20207

Message Description: LOG_ID_RAD_MISMATCH_VALID_TIME
Message Meaning: RADVD local AdvValidLifetime disagrees with remote site
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 315

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20208 - LOG_ID_ZOMBIE_DAEMON_CLEANUP

Message ID: 20208

Message Description: LOG_ID_ZOMBIE_DAEMON_CLEANUP
Message Meaning: Zombie daemon cleanup
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

daemon Daemon Name string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

pid Process ID uint32 10

FortiOS 6.0.10 Log Reference 316

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20209 - LOG_ID_DISK_UNAVAIL

Message ID: 20209

Message Description: LOG_ID_DISK_UNAVAIL
Message Meaning: Disk unavailable
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20210 - LOG_ID_DISK_TRIM_START

Message ID: 20210

Message Description: LOG_ID_DISK_TRIM_START
Message Meaning: SSD TRIM started
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 317

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20211 - LOG_ID_DISK_TRIM_END

Message ID: 20211

Message Description: LOG_ID_DISK_TRIM_END
Message Meaning: SSD TRIM finished
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 318

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

20212 - LOG_ID_DISK_SCAN_NEEDED

Message ID: 20212

Message Description: LOG_ID_DISK_SCAN_NEEDED
Message Meaning: Disk scan is needed
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20220 - LOGID_EVENT_SHAPER_OUTBOUND_MAXED_OUT

Message ID: 20220

FortiOS 6.0.10 Log Reference 319

Fortinet, Inc.
Log Messages

Message Description: LOGID_EVENT_SHAPER_OUTBOUND_MAXED_OUT

Message Meaning: Outbound bandwidth rate exceeded
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

intf Interface string 16

level Log Level string 11

limit Virtual Domain Resource Limit uint32 10

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20221 - LOGID_EVENT_SHAPER_INBOUND_MAXED_OUT

Message ID: 20221

Message Description: LOGID_EVENT_SHAPER_INBOUND_MAXED_OUT
Message Meaning: Inbound bandwidth rate exceeded
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 320

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

intf Interface string 16

level Log Level string 11

limit Virtual Domain Resource Limit uint32 10

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20300 - LOG_ID_BGP_NB_STAT_CHG

Message ID: 20300

Message Description: LOG_ID_BGP_NB_STAT_CHG
Message Meaning: BGP neighbor status changed
Type: Event
Category: ROUTER
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 321

Fortinet, Inc.
Log Messages

20301 - LOG_ID_VZ_LOG

Message ID: 20301

Message Description: LOG_ID_VZ_LOG
Message Meaning: Routing log
Type: Event
Category: ROUTER
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20302 - LOG_ID_OSPF_NB_STAT_CHG

Message ID: 20302

Message Description: LOG_ID_OSPF_NB_STAT_CHG
Message Meaning: OSPF neighbor status changed
Type: Event
Category: ROUTER
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 322

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20303 - LOG_ID_OSPF6_NB_STAT_CHG

Message ID: 20303

Message Description: LOG_ID_OSPF6_NB_STAT_CHG
Message Meaning: OSPF6 neighbor status changed
Type: Event
Category: ROUTER
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

20401 - LOG_ID_ROUTER_CLEAR

Message ID: 20401

FortiOS 6.0.10 Log Reference 323

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_ROUTER_CLEAR

Message Meaning: Router cleared
Type: Event
Category: ROUTER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui string 64

user string 256

vd Virtual Domain Name string 32

22000 - LOG_ID_INV_PKT_LEN

Message ID: 22000

Message Description: LOG_ID_INV_PKT_LEN
Message Meaning: Packet length mismatch
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 324

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22001 - LOG_ID_UNSUPPORTED_PROT_VER

Message ID: 22001

Message Description: LOG_ID_UNSUPPORTED_PROT_VER
Message Meaning: Protocol version unsupported
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 325

Fortinet, Inc.
Log Messages

22002 - LOG_ID_INV_REQ_TYPE

Message ID: 22002

Message Description: LOG_ID_INV_REQ_TYPE
Message Meaning: Request type not supported
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22003 - LOG_ID_FAIL_SET_SIG_HANDLER

Message ID: 22003

Message Description: LOG_ID_FAIL_SET_SIG_HANDLER
Message Meaning: Signal handler setup failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 326

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22004 - LOG_ID_FAIL_CREATE_SOCKET

Message ID: 22004

Message Description: LOG_ID_FAIL_CREATE_SOCKET
Message Meaning: Socket creation failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22005 - LOG_ID_FAIL_CREATE_SOCKET_RETRY

Message ID: 22005

Message Description: LOG_ID_FAIL_CREATE_SOCKET_RETRY

FortiOS 6.0.10 Log Reference 327

Fortinet, Inc.
Log Messages

Message Meaning: Socket creation retry failed

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22006 - LOG_ID_FAIL_REG_CMDB_EVENT

Message ID: 22006

Message Description: LOG_ID_FAIL_REG_CMDB_EVENT
Message Meaning: Registration for CMDB events failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 328

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22009 - LOG_ID_FAIL_FIND_AV_PROFILE

Message ID: 22009

Message Description: LOG_ID_FAIL_FIND_AV_PROFILE
Message Meaning: AntiVirus profile not found
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22010 - LOG_ID_SENDTO_FAIL

Message ID: 22010

Message Description: LOG_ID_SENDTO_FAIL
Message Meaning: URL filter packet send failure

FortiOS 6.0.10 Log Reference 329

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

process Process string

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22011 - LOG_ID_ENTER_MEM_CONSERVE_MODE

Message ID: 22011

Message Description: LOG_ID_ENTER_MEM_CONSERVE_MODE
Message Meaning: Memory conserve mode entered
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

conserve Flag for Conserve Mode string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

green string 32

FortiOS 6.0.10 Log Reference 330

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

red string 32

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

total Total uint32 10

type Log Type string 16

used Number of Used IPs uint32 10

vd Virtual Domain Name string 32

22012 - LOG_ID_LEAVE_MEM_CONSERVE_MODE

Message ID: 22012

Message Description: LOG_ID_LEAVE_MEM_CONSERVE_MODE
Message Meaning: Memory conserve mode exited
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

conserve Flag for Conserve Mode string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

green string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 331

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

red string 32

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

total Total uint32 10

type Log Type string 16

used Number of Used IPs uint32 10

vd Virtual Domain Name string 32

22013 - LOG_ID_IPPOOLPBA_BLOCK_EXHAUSTED

Message ID: 22013

Message Description: LOG_ID_IPPOOLPBA_BLOCK_EXHAUSTED
Message Meaning: IP pool PBA block exhausted
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

poolname IP Pool Name string 36

saddr Source Address IP string 80

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 332

Fortinet, Inc.
Log Messages

22014 - LOG_ID_IPPOOLPBA_NATIP_EXHAUSTED

Message ID: 22014

Message Description: LOG_ID_IPPOOLPBA_NATIP_EXHAUSTED
Message Meaning: IP pool PBA NAT IP exhausted
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

poolname IP Pool Name string 36

saddr Source Address IP string 80

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22015 - LOG_ID_IPPOOLPBA_CREATE

Message ID: 22015

Message Description: LOG_ID_IPPOOLPBA_CREATE
Message Meaning: IP pool PBA created
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 333

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

nat NAT IP Address ip 39

poolname IP Pool Name string 36

portbegin Port Number to Begin uint16 5

portend Port Number to End uint16 5

saddr Source Address IP string 80

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22016 - LOG_ID_IPPOOLPBA_DEALLOCATE

Message ID: 22016

Message Description: LOG_ID_IPPOOLPBA_DEALLOCATE
Message Meaning: Deallocate IP pool PBA
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

duration Duration uint32 10

FortiOS 6.0.10 Log Reference 334

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

nat NAT IP Address ip 39

poolname IP Pool Name string 36

portbegin Port Number to Begin uint16 5

portend Port Number to End uint16 5

saddr Source Address IP string 80

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22017 - LOG_ID_EXCEED_GLOB_RES_LIMIT

Message ID: 22017

Message Description: LOG_ID_EXCEED_GLOB_RES_LIMIT
Message Meaning: Global resource limit exceeded
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 335

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22018 - LOG_ID_EXCEED_VD_RES_LIMIT

Message ID: 22018

Message Description: LOG_ID_EXCEED_VD_RES_LIMIT
Message Meaning: VDOM resource limit exceeded
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22020 - LOG_ID_FAIL_CREATE_HA_SOCKET

Message ID: 22020

Message Description: LOG_ID_FAIL_CREATE_HA_SOCKET
Message Meaning: HA socket creation failed

FortiOS 6.0.10 Log Reference 336

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22021 - LOG_ID_FAIL_CREATE_HA_SOCKET_RETRY

Message ID: 22021

Message Description: LOG_ID_FAIL_CREATE_HA_SOCKET_RETRY
Message Meaning: UDP socket creation to relay URL request failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 337

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22030 - LOG_ID_FAIL_CSF_LOG_SYNC_NO_VALID_FAZ

Message ID: 22030

Message Description: LOG_ID_FAIL_CSF_LOG_SYNC_NO_VALID_FAZ
Message Meaning: FortiAnalyzer is not configured for Security Fabric service
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

server Server IP Address string 64

sn Serial Number string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22031 - LOG_ID_SUCCESS_CSF_LOG_SYNC_CONFIG_CHANGED

Message ID: 22031

FortiOS 6.0.10 Log Reference 338

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_SUCCESS_CSF_LOG_SYNC_CONFIG_CHANGED

Message Meaning: Settings modified by Security Fabric service
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

sn Serial Number string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22032 - LOG_ID_CSF_LOOP_FOUND

Message ID: 22032

Message Description: LOG_ID_CSF_LOOP_FOUND
Message Meaning: Looped configuration in Security Fabric service
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 339

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

path string 512

reason Reason string 256

sn Serial Number string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22033 - LOG_ID_FAIL_CSF_LOG_SYNC_NO_VALID_FSA

Message ID: 22033

Message Description: LOG_ID_FAIL_CSF_LOG_SYNC_NO_VALID_FSA
Message Meaning: CSF root FSA configuration is not properly set
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

FortiOS 6.0.10 Log Reference 340

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

server Server IP Address string 64

sn Serial Number string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22035 - LOG_ID_CSF_UPSTREAM_SN_CHANGED

Message ID: 22035

Message Description: LOG_ID_CSF_UPSTREAM_SN_CHANGED
Message Meaning: Serial number of upstream is changed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

oldsn string 64

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 341

Fortinet, Inc.
Log Messages

22100 - LOG_ID_QUAR_DROP_TRAN_JOB

Message ID: 22100

Message Description: LOG_ID_QUAR_DROP_TRAN_JOB
Message Meaning: Files dropped by quarantine daemon
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

count Count uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

fams_pause Fortinet Analysis and Management Service Pause uint32 10

level Log Level string 11

limit Virtual Domain Resource Limit uint32 10

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

used Number of Used IPs uint32 10

vd Virtual Domain Name string 32

22101 - LOG_ID_QUAR_DROP_TLL_JOB

Message ID: 22101

Message Description: LOG_ID_QUAR_DROP_TLL_JOB
Message Meaning: Files dropped due to poor network connection

FortiOS 6.0.10 Log Reference 342

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

count Count uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22102 - LOG_ID_LOG_DISK_FAILURE

Message ID: 22102

Message Description: LOG_ID_LOG_DISK_FAILURE
Message Meaning: Log disk failure imminent
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 343

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22103 - LOG_ID_QUAR_LIMIT_REACHED

Message ID: 22103

Message Description: LOG_ID_QUAR_LIMIT_REACHED
Message Meaning: Sandbox limit reached
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

count Count uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

limit Virtual Domain Resource Limit uint32 10

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 344

Fortinet, Inc.
Log Messages

22104 - LOG_ID_POWER_RESTORE

Message ID: 22104

Message Description: LOG_ID_POWER_RESTORE
Message Meaning: Power supply restored
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unit Unit uint32 10

vd Virtual Domain Name string 32

22105 - LOG_ID_POWER_FAILURE

Message ID: 22105

Message Description: LOG_ID_POWER_FAILURE
Message Meaning: Power supply failed
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 345

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unit Unit uint32 10

vd Virtual Domain Name string 32

22106 - LOG_ID_POWER_OPTIONAL_NOT_DETECTED

Message ID: 22106

Message Description: LOG_ID_POWER_OPTIONAL_NOT_DETECTED
Message Meaning: Optional power supply not detected
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 346

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22107 - LOG_ID_VOLT_ANOM

Message ID: 22107

Message Description: LOG_ID_VOLT_ANOM
Message Meaning: Voltage anomaly
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22108 - LOG_ID_FAN_ANOM

Message ID: 22108

FortiOS 6.0.10 Log Reference 347

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_FAN_ANOM

Message Meaning: Fan anomaly
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22109 - LOG_ID_TEMP_TOO_HIGH

Message ID: 22109

Message Description: LOG_ID_TEMP_TOO_HIGH
Message Meaning: Temperature too high
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 348

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22110 - LOG_ID_SPARE_BLOCK_LOW

Message ID: 22110

Message Description: LOG_ID_SPARE_BLOCK_LOW
Message Meaning: Spare blocks availability low
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 349

Fortinet, Inc.
Log Messages

22113 - LOG_ID_FNBAM_FAILURE

Message ID: 22113

Message Description: LOG_ID_FNBAM_FAILURE
Message Meaning: Authentication error
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22150 - LOG_ID_VOLT_NOM

Message ID: 22150

Message Description: LOG_ID_VOLT_NOM
Message Meaning: Voltage normal
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 350

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22151 - LOG_ID_FAN_NOM

Message ID: 22151

Message Description: LOG_ID_FAN_NOM
Message Meaning: Fan normal
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 351

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22152 - LOG_ID_TEMP_TOO_LOW

Message ID: 22152

Message Description: LOG_ID_TEMP_TOO_LOW
Message Meaning: Temperature too low
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22153 - LOG_ID_TEMP_NORM

Message ID: 22153

Message Description: LOG_ID_TEMP_NORM
Message Meaning: Temperature normal
Type: Event

FortiOS 6.0.10 Log Reference 352

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22200 - LOG_ID_AUTO_UPT_CERT

Message ID: 22200

Message Description: LOG_ID_AUTO_UPT_CERT
Message Meaning: Certificate will be auto-updated
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

cert Certificate string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 353

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22201 - LOG_ID_AUTO_GEN_CERT

Message ID: 22201

Message Description: LOG_ID_AUTO_GEN_CERT
Message Meaning: Certificate will be auto-regenerated
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

cert Certificate string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 354

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

22203 - LOG_ID_AUTO_GEN_CERT_FAIL

Message ID: 22203

Message Description: LOG_ID_AUTO_GEN_CERT_FAIL
Message Meaning: Certificate failed to auto-generate
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22204 - LOG_ID_AUTO_GEN_CERT_PENDING

Message ID: 22204

Message Description: LOG_ID_AUTO_GEN_CERT_PENDING
Message Meaning: Certificate pending to auto-generate

FortiOS 6.0.10 Log Reference 355

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22205 - LOG_ID_AUTO_GEN_CERT_SUCC

Message ID: 22205

Message Description: LOG_ID_AUTO_GEN_CERT_SUCC
Message Meaning: Certificate succeed to auto-generate
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 356

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22206 - LOG_ID_CRL_EXPIRED

Message ID: 22206

Message Description: LOG_ID_CRL_EXPIRED
Message Meaning: CRL is expired
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

FortiOS 6.0.10 Log Reference 357

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22700 - LOG_ID_IPS_FAIL_OPEN

Message ID: 22700

Message Description: LOG_ID_IPS_FAIL_OPEN
Message Meaning: IPS session scan paused
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22701 - LOG_ID_IPS_FAIL_OPEN_END

Message ID: 22701

Message Description: LOG_ID_IPS_FAIL_OPEN_END
Message Meaning: IPS session scan resumed

FortiOS 6.0.10 Log Reference 358

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22800 - LOG_ID_SCAN_SERV_FAIL

Message ID: 22800

Message Description: LOG_ID_SCAN_SERV_FAIL
Message Meaning: Scan services session failed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mode Mode string 12

FortiOS 6.0.10 Log Reference 359

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22802 - LOG_ID_ENTER_FD_CONSERVE_MODE

Message ID: 22802

Message Description: LOG_ID_ENTER_FD_CONSERVE_MODE
Message Meaning: File descriptor conserve mode entered
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

conserve Flag for Conserve Mode string 32

daemon Daemon Name string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

green string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

red string 32

subtype Log Subtype string 20

time Time string 8

total Total uint32 10

type Log Type string 16

FortiOS 6.0.10 Log Reference 360

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

used Number of Used IPs uint32 10

vd Virtual Domain Name string 32

22803 - LOG_ID_LEAVE_FD_CONSERVE_MODE

Message ID: 22803

Message Description: LOG_ID_LEAVE_FD_CONSERVE_MODE
Message Meaning: File descriptor conserve mode exited
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

conserve Flag for Conserve Mode string 32

daemon Daemon Name string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

green string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

red string 32

subtype Log Subtype string 20

time Time string 8

total Total uint32 10

type Log Type string 16

used Number of Used IPs uint32 10

vd Virtual Domain Name string 32

22804 - LOG_ID_LIC_STATUS_CHG

Message ID: 22804

FortiOS 6.0.10 Log Reference 361

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_LIC_STATUS_CHG

Message Meaning: License status changed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22805 - LOG_ID_FAIL_TO_VALIDATE_LIC

Message ID: 22805

Message Description: LOG_ID_FAIL_TO_VALIDATE_LIC
Message Meaning: License validation failure
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 362

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22806 - LOG_ID_DUP_LIC

Message ID: 22806

Message Description: LOG_ID_DUP_LIC
Message Meaning: Duplicate license detected
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 363

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

22808 - LOG_ID_LIC_EXPIRE

Message ID: 22808

Message Description: LOG_ID_LIC_EXPIRE
Message Meaning: VM license expired
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22809 - LOG_ID_LIC_WILL_EXPIRE

Message ID: 22809

Message Description: LOG_ID_LIC_WILL_EXPIRE
Message Meaning: VM license expiring
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 364

Fortinet, Inc.
Log Messages

Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

service Name of Service string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22891 - LOG_ID_FLCFGD_SYNC_ERROR

Message ID: 22891

Message Description: LOG_ID_FLCFGD_SYNC_ERROR
Message Meaning: Switch-Controller Switch Sync Error
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 365

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

22892 - LOG_ID_FLCFGD_SYNC_COMPLETE

Message ID: 22892

Message Description: LOG_ID_FLCFGD_SYNC_COMPLETE
Message Meaning: Switch-Controller Switch Sync Complete
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

22893 - LOG_ID_FLCFGD_SYNC_STATE

Message ID: 22893

FortiOS 6.0.10 Log Reference 366

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_FLCFGD_SYNC_STATE

Message Meaning: Switch-Controller Switch Sync State
Type: Event
Category: SYSTEM
Severity: Debug

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

22894 - LOG_ID_FLCFGD_UPGRADE_ERROR

Message ID: 22894

Message Description: LOG_ID_FLCFGD_UPGRADE_ERROR
Message Meaning: Switch-Controller Switch Upgrade Error
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 367

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

22895 - LOG_ID_FLCFGD_UPGRADE_STATUS

Message ID: 22895

Message Description: LOG_ID_FLCFGD_UPGRADE_STATUS
Message Meaning: Switch-Controller Switch Upgrade Status
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 368

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

22900 - LOG_ID_CAPUTP_SESSION

Message ID: 22900

Message Description: LOG_ID_CAPUTP_SESSION
Message Meaning: CAPUTP session status
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22901 - LOG_ID_FAZ_CON

Message ID: 22901

Message Description: LOG_ID_FAZ_CON
Message Meaning: FortiAnalyzer connection up
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 369

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22902 - LOG_ID_FAZ_DISCON

Message ID: 22902

Message Description: LOG_ID_FAZ_DISCON
Message Meaning: FortiAnalyzer connection down
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 370

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22903 - LOG_ID_FAZ_CON_ERR

Message ID: 22903

Message Description: LOG_ID_FAZ_CON_ERR
Message Meaning: FortiAnalyzer connection failed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 371

Fortinet, Inc.
Log Messages

22904 - LOG_ID_CAPUTP_SESSION_NOTIF

Message ID: 22904

Message Description: LOG_ID_CAPUTP_SESSION_NOTIF
Message Meaning: CAPUTP session status notification
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

22912 - LOG_ID_FDS_SRV_ERRCON

Message ID: 22912

Message Description: LOG_ID_FDS_SRV_ERRCON
Message Meaning: FortiCloud server connection failed
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 372

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

server Server IP Address string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22913 - LOG_ID_FDS_SRV_DISCON

Message ID: 22913

Message Description: LOG_ID_FDS_SRV_DISCON
Message Meaning: FortiCloud server disconnected
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 373

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

server Server IP Address string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22914 - LOG_ID_FDS_SRV_CHG

Message ID: 22914

Message Description: LOG_ID_FDS_SRV_CHG
Message Meaning: FortiCloud server changed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

server Server IP Address string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22915 - LOG_ID_FDS_SRV_CON

Message ID: 22915

FortiOS 6.0.10 Log Reference 374

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_FDS_SRV_CON

Message Meaning: FortiCloud server connected
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

server Server IP Address string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22916 - LOG_ID_FDS_STATUS

Message ID: 22916

Message Description: LOG_ID_FDS_STATUS
Message Meaning: FortiGuard Message Service status
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 375

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22917 - LOG_ID_FDS_SMS_QUOTA

Message ID: 22917

Message Description: LOG_ID_FDS_SMS_QUOTA
Message Meaning: SMS quota reached
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 376

Fortinet, Inc.
Log Messages

22918 - LOG_ID_FDS_CTRL_STATUS

Message ID: 22918

Message Description: LOG_ID_FDS_CTRL_STATUS
Message Meaning: FortiGuard Message Service controller status
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22921 - LOG_ID_EVENT_ROUTE_INFO_CHANGED

Message ID: 22921

Message Description: LOG_ID_EVENT_ROUTE_INFO_CHANGED
Message Meaning: Routing information changed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 377

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22922 - LOG_ID_EVENT_LINK_MONITOR_STATUS

Message ID: 22922

Message Description: LOG_ID_EVENT_LINK_MONITOR_STATUS
Message Meaning: Link monitor status
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

FortiOS 6.0.10 Log Reference 378

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

probeproto Link Monitor Probe Protocol string 16

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22923 - LOG_ID_EVENT_VWL_LQTY_STATUS

Message ID: 22923

Message Description: LOG_ID_EVENT_VWL_LQTY_STATUS
Message Meaning: Virtual WAN Link status
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22924 - LOG_ID_EVENT_VWL_VOLUME_STATUS

Message ID: 22924

Message Description: LOG_ID_EVENT_VWL_VOLUME_STATUS
Message Meaning: Virtual WAN Link volume status

FortiOS 6.0.10 Log Reference 379

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

22949 - LOG_ID_FDS_JOIN

Message ID: 22949

Message Description: LOG_ID_FDS_JOIN
Message Meaning: FortiCloud auto-join attempted
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 380

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22950 - LOG_ID_FDS_LOGIN_SUCC

Message ID: 22950

Message Description: LOG_ID_FDS_LOGIN_SUCC
Message Meaning: FortiCloud activation successful
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 381

Fortinet, Inc.
Log Messages

22951 - LOG_ID_FDS_LOGOUT

Message ID: 22951

Message Description: LOG_ID_FDS_LOGOUT
Message Meaning: FortiCloud logout
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22952 - LOG_ID_FDS_LOGIN_FAIL

Message ID: 22952

Message Description: LOG_ID_FDS_LOGIN_FAIL
Message Meaning: FortiCloud activation failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 382

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

22953 - LOG_ID_IOC_DETECTED

Message ID: 22953

Message Description: LOG_ID_IOC_DETECTED
Message Meaning: Compromised host detected
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 383

Fortinet, Inc.
Log Messages

23101 - LOG_ID_IPSEC_TUNNEL_UP

Message ID: 23101

Message Description: LOG_ID_IPSEC_TUNNEL_UP
Message Meaning: IPsec VPN tunnel up
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

23102 - LOG_ID_IPSEC_TUNNEL_DOWN

Message ID: 23102

Message Description: LOG_ID_IPSEC_TUNNEL_DOWN
Message Meaning: IPsec VPN tunnel down
Type: Event

FortiOS 6.0.10 Log Reference 384

Fortinet, Inc.
Log Messages

Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

23103 - LOG_ID_IPSEC_TUNNEL_STAT

Message ID: 23103

Message Description: LOG_ID_IPSEC_TUNNEL_STAT
Message Meaning: IPsec VPN tunnel statistics
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 385

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

26001 - LOG_ID_DHCP_ACK

Message ID: 26001

Message Description: LOG_ID_DHCP_ACK
Message Meaning: DHCP Ack log
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dhcp_msg DHCP Message string

eventtime uint64 20

hostname Hostname string 128

FortiOS 6.0.10 Log Reference 386

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

interface Interface string 32

ip ip 39

lease DHCP Lease uint32 10

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mac Mac Address string 17

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26002 - LOG_ID_DHCP_RELEASE

Message ID: 26002

Message Description: LOG_ID_DHCP_RELEASE
Message Meaning: DHCP Release log
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dhcp_msg DHCP Message string

eventtime uint64 20

hostname Hostname string 128

interface Interface string 32

ip ip 39

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 387

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

mac Mac Address string 17

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26003 - LOG_ID_DHCP_STAT

Message ID: 26003

Message Description: LOG_ID_DHCP_STAT
Message Meaning: DHCP statistics
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

total Total uint32 10

type Log Type string 16

used Number of Used IPs uint32 10

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 388

Fortinet, Inc.
Log Messages

26004 - LOG_ID_DHCP_CLIENT_LEASE

Message ID: 26004

Message Description: LOG_ID_DHCP_CLIENT_LEASE
Message Meaning: DHCP client lease granted
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26005 - LOG_ID_DHCP_LEASE_USAGE_HIGH

Message ID: 26005

Message Description: LOG_ID_DHCP_LEASE_USAGE_HIGH
Message Meaning: DHCP lease usage high
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 389

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26006 - LOG_ID_DHCP_LEASE_USAGE_FULL

Message ID: 26006

Message Description: LOG_ID_DHCP_LEASE_USAGE_FULL
Message Meaning: DHCP lease usage full
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 390

Fortinet, Inc.
Log Messages

26007 - LOG_ID_DHCP_BLOCKED_MAC

Message ID: 26007

Message Description: LOG_ID_DHCP_BLOCKED_MAC
Message Meaning: DHCP client blocked log
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface Interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mac Mac Address string 17

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26008 - LOG_ID_DHCP_DDNS_ADD

Message ID: 26008

Message Description: LOG_ID_DHCP_DDNS_ADD
Message Meaning: DHCP DDNS add query
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

FortiOS 6.0.10 Log Reference 391

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ddnsserver DDNS Server ip 39

devid Device ID string 16

dhcp_msg DHCP Message string

eventtime uint64 20

fqdn string 256

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26009 - LOG_ID_DHCP_DDNS_DELETE

Message ID: 26009

Message Description: LOG_ID_DHCP_DDNS_DELETE
Message Meaning: DHCP DDNS delete query
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

ddnsserver DDNS Server ip 39

devid Device ID string 16

dhcp_msg DHCP Message string

eventtime uint64 20

fqdn string 256

ip ip 39

FortiOS 6.0.10 Log Reference 392

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26010 - LOG_ID_DHCP_DDNS_COMPLETED

Message ID: 26010

Message Description: LOG_ID_DHCP_DDNS_COMPLETED
Message Meaning: DHCP DDNS query completed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

ddnsserver DDNS Server ip 39

devid Device ID string 16

dhcp_msg DHCP Message string

eventtime uint64 20

fqdn string 256

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 393

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

26011 - LOG_ID_DHCPV6_REPLY

Message ID: 26011

Message Description: LOG_ID_DHCPV6_REPLY
Message Meaning: DHCPv6 Ack log
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dhcp_msg DHCP Message string

duid string 128

eventtime uint64 20

iaid uint32 10

interface Interface string 32

ip ip 39

lease DHCP Lease uint32 10

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

26012 - LOG_ID_DHCPV6_RELEASE

Message ID: 26012

FortiOS 6.0.10 Log Reference 394

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_DHCPV6_RELEASE

Message Meaning: DHCPv6 Release log
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dhcp_msg DHCP Message string

duid string 128

eventtime uint64 20

iaid uint32 10

interface Interface string 32

ip ip 39

lease DHCP Lease uint32 10

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

27001 - LOG_ID_VRRP_STATE_CHG

Message ID: 27001

Message Description: LOG_ID_VRRP_STATE_CHG
Message Meaning: VRRP state changed
Type: Event
Category: ROUTER
Severity: Information

FortiOS 6.0.10 Log Reference 395

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29001 - LOG_ID_PPPD_MSG

Message ID: 29001

Message Description: LOG_ID_PPPD_MSG
Message Meaning: PPP status
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

assigned Assigned IP Address ip 39

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

local Local IP for a PPPD Connection ip 39

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 396

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

remote Remote IP Address ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

29002 - LOG_ID_PPPD_AUTH_SUC

Message ID: 29002

Message Description: LOG_ID_PPPD_AUTH_SUC
Message Meaning: PPP authentication successful
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assigned Assigned IP Address ip 39

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

local Local IP for a PPPD Connection ip 39

logdesc Log Description string

logid Log ID string 10

msg Message Text string

remote Remote IP Address ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 397

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

29003 - LOG_ID_PPPD_AUTH_FAIL

Message ID: 29003

Message Description: LOG_ID_PPPD_AUTH_FAIL
Message Meaning: PPP authentication failed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assigned Assigned IP Address ip 39

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

local Local IP for a PPPD Connection ip 39

logdesc Log Description string

logid Log ID string 10

msg Message Text string

remote Remote IP Address ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29010 - LOG_ID_PPPOE_STATUS_REPORT_NOTIF

Message ID: 29010

Message Description: LOG_ID_PPPOE_STATUS_REPORT_NOTIF
Message Meaning: PPPoE status report

FortiOS 6.0.10 Log Reference 398

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

assigned Assigned IP Address ip 39

date Date string 10

devid Device ID string 16

eventtime uint64 20

gateway gateway ip address for PPPoE status report ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

mtu Max Transmission Unit Value uint32 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29011 - LOG_ID_PPPD_FAIL_TO_EXEC

Message ID: 29011

Message Description: LOG_ID_PPPD_FAIL_TO_EXEC
Message Meaning: PPP execution failed
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 399

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29012 - LOG_ID_PPP_OPT_ERR

Message ID: 29012

Message Description: LOG_ID_PPP_OPT_ERR
Message Meaning: PPP received incorrect options
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29013 - LOG_ID_PPPD_START

Message ID: 29013

Message Description: LOG_ID_PPPD_START
Message Meaning: PPP daemon started

FortiOS 6.0.10 Log Reference 400

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29014 - LOG_ID_PPPD_EXIT

Message ID: 29014

Message Description: LOG_ID_PPPD_EXIT
Message Meaning: PPP daemon exited
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 401

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29015 - LOG_ID_PPP_RCV_BAD_PEER_IP

Message ID: 29015

Message Description: LOG_ID_PPP_RCV_BAD_PEER_IP
Message Meaning: PPP received invalid peer IP
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29016 - LOG_ID_PPP_RCV_BAD_LOCAL_IP

Message ID: 29016

Message Description: LOG_ID_PPP_RCV_BAD_LOCAL_IP
Message Meaning: PPP received invalid local IP
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 402

Fortinet, Inc.
Log Messages

Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

29017 - LOG_ID_PPP_OPT_NOTIF

Message ID: 29017

Message Description: LOG_ID_PPP_OPT_NOTIF
Message Meaning: PPP received incorrect notifications
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 403

Fortinet, Inc.
Log Messages

29021 - LOG_ID_EVENT_AUTH_SNMP_QUERY_FAILED

Message ID: 29021

Message Description: LOG_ID_EVENT_AUTH_SNMP_QUERY_FAILED
Message Meaning: SNMP query failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

community Community string 36

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

version Version string 64

29022 - LOG_ID_DDNS_UPDATE_FAIL

Message ID: 29022

Message Description: LOG_ID_DDNS_UPDATE_FAIL
Message Meaning: DDNS update failed
Type: Event

FortiOS 6.0.10 Log Reference 404

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32001 - LOG_ID_ADMIN_LOGIN_SUCC

Message ID: 32001

Message Description: LOG_ID_ADMIN_LOGIN_SUCC
Message Meaning: Admin login successful
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method string 64

FortiOS 6.0.10 Log Reference 405

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32002 - LOG_ID_ADMIN_LOGIN_FAIL

Message ID: 32002

Message Description: LOG_ID_ADMIN_LOGIN_FAIL
Message Meaning: Admin login failed
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method string 64

FortiOS 6.0.10 Log Reference 406

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32003 - LOG_ID_ADMIN_LOGOUT

Message ID: 32003

Message Description: LOG_ID_ADMIN_LOGOUT
Message Meaning: Admin logout successful
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method string 64

FortiOS 6.0.10 Log Reference 407

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

state string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32005 - LOG_ID_ADMIN_OVERIDE_VDOM

Message ID: 32005

Message Description: LOG_ID_ADMIN_OVERIDE_VDOM
Message Meaning: Admin overrode VDOM
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

FortiOS 6.0.10 Log Reference 408

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32006 - LOG_ID_ADMIN_ENTER_VDOM

Message ID: 32006

Message Description: LOG_ID_ADMIN_ENTER_VDOM
Message Meaning: Super admin entered VDOM
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 409

Fortinet, Inc.
Log Messages

32007 - LOG_ID_ADMIN_LEFT_VDOM

Message ID: 32007

Message Description: LOG_ID_ADMIN_LEFT_VDOM
Message Meaning: Super admin left VDOM
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32008 - LOG_ID_VIEW_DISK_LOG_FAIL

Message ID: 32008

Message Description: LOG_ID_VIEW_DISK_LOG_FAIL
Message Meaning: Disk log access failed
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 410

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32009 - LOG_ID_SYSTEM_START

Message ID: 32009

Message Description: LOG_ID_SYSTEM_START
Message Meaning: FortiGate started
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 411

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32010 - LOG_ID_DISK_LOG_FULL

Message ID: 32010

Message Description: LOG_ID_DISK_LOG_FULL
Message Meaning: Disk full
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32011 - LOG_ID_LOG_ROLL

Message ID: 32011

Message Description: LOG_ID_LOG_ROLL
Message Meaning: Disk log rolled
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 412

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

log Log Name for Log Rotation string 32

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32014 - LOG_ID_CS_LIC_EXPIRE

Message ID: 32014

Message Description: LOG_ID_CS_LIC_EXPIRE
Message Meaning: Support license expiring
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 413

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32015 - LOG_ID_DISK_LOG_USAGE

Message ID: 32015

Message Description: LOG_ID_DISK_LOG_USAGE
Message Meaning: Log disk full
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32016 - LOG_ID_FDS_QUOTA_WARN

Message ID: 32016

Message Description: LOG_ID_FDS_QUOTA_WARN
Message Meaning: FortiCloud quota full third warning
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 414

Fortinet, Inc.
Log Messages

Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32017 - LOG_ID_FDS_DAILY_QUOTA_FULL

Message ID: 32017

Message Description: LOG_ID_FDS_DAILY_QUOTA_FULL
Message Meaning: FortiCloud daily quota full
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 415

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

32018 - LOG_ID_FIPS_ENTER_ERR_MOD

Message ID: 32018

Message Description: LOG_ID_FIPS_ENTER_ERR_MOD
Message Meaning: FIPS CC entered error mode
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32019 - LOG_ID_CC_ENTER_ERR_MOD

Message ID: 32019

Message Description: LOG_ID_CC_ENTER_ERR_MOD
Message Meaning: CC entered error mode
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 416

Fortinet, Inc.
Log Messages

Severity: Emergency

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32020 - LOG_ID_SSH_CORRPUT_MAC

Message ID: 32020

Message Description: LOG_ID_SSH_CORRPUT_MAC
Message Meaning: Message Authentication Code corrupted
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 417

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

ui User Interface string 64

vd Virtual Domain Name string 32

32021 - LOG_ID_ADMIN_LOGIN_DISABLE

Message ID: 32021

Message Description: LOG_ID_ADMIN_LOGIN_DISABLE
Message Meaning: Admin login disabled
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 418

Fortinet, Inc.
Log Messages

32022 - LOG_ID_VDOM_ENABLED

Message ID: 32022

Message Description: LOG_ID_VDOM_ENABLED
Message Meaning: VDOM enabled
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32023 - LOG_ID_MEM_LOG_FIRST_FULL

Message ID: 32023

Message Description: LOG_ID_MEM_LOG_FIRST_FULL
Message Meaning: Memory log full over first warning level
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

FortiOS 6.0.10 Log Reference 419

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32024 - LOG_ID_ADMIN_PASSWD_EXPIRE

Message ID: 32024

Message Description: LOG_ID_ADMIN_PASSWD_EXPIRE
Message Meaning: Admin password expired
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 420

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32025 - LOG_ID_SSH_REKEY

Message ID: 32025

Message Description: LOG_ID_SSH_REKEY
Message Meaning: SSH server re-key
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

vd Virtual Domain Name string 32

32026 - LOG_ID_SSH_BAD_PACKET_LENGTH

Message ID: 32026

Message Description: LOG_ID_SSH_BAD_PACKET_LENGTH
Message Meaning: SSH server received bad length packet
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 421

Fortinet, Inc.
Log Messages

Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

vd Virtual Domain Name string 32

32027 - LOG_ID_VIEW_DISK_LOG_SUCC

Message ID: 32027

Message Description: LOG_ID_VIEW_DISK_LOG_SUCC
Message Meaning: Disk logs viewed successfully
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 422

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32028 - LOG_ID_LOG_DEL_DIR

Message ID: 32028

Message Description: LOG_ID_LOG_DEL_DIR
Message Meaning: Disk log directory deleted
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32029 - LOG_ID_LOG_DEL_FILE

Message ID: 32029

Message Description: LOG_ID_LOG_DEL_FILE
Message Meaning: Disk log file deleted
Type: Event

FortiOS 6.0.10 Log Reference 423

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

filesize Report File Size in Bytes uint32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32030 - LOG_ID_SEND_FDS_STAT

Message ID: 32030

Message Description: LOG_ID_SEND_FDS_STAT
Message Meaning: FDS statistics sent
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 424

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32031 - LOG_ID_VIEW_MEM_LOG_FAIL

Message ID: 32031

Message Description: LOG_ID_VIEW_MEM_LOG_FAIL
Message Meaning: Memory log access failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 425

Fortinet, Inc.
Log Messages

32032 - LOG_ID_DISK_DLP_ARCH_FULL

Message ID: 32032

Message Description: LOG_ID_DISK_DLP_ARCH_FULL
Message Meaning: DLP archive full
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32033 - LOG_ID_DISK_QUAR_FULL

Message ID: 32033

Message Description: LOG_ID_DISK_QUAR_FULL
Message Meaning: Quarantine full
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 426

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32034 - LOG_ID_DISK_REPORT_FULL

Message ID: 32034

Message Description: LOG_ID_DISK_REPORT_FULL
Message Meaning: Report full
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32035 - LOG_ID_VDOM_DISABLED

Message ID: 32035

FortiOS 6.0.10 Log Reference 427

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_VDOM_DISABLED

Message Meaning: VDOM disabled
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32036 - LOG_ID_DISK_IPS_ARCH_FULL

Message ID: 32036

Message Description: LOG_ID_DISK_IPS_ARCH_FULL
Message Meaning: IPS archive full
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 428

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32037 - LOG_ID_DISK_LOG_FIRST_FULL

Message ID: 32037

Message Description: LOG_ID_DISK_LOG_FIRST_FULL
Message Meaning: Disk log full over first warning
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32038 - LOG_ID_LOG_ROLL_FORTICRON

Message ID: 32038

FortiOS 6.0.10 Log Reference 429

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_LOG_ROLL_FORTICRON

Message Meaning: Log rotation requested by FortiCron
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

log Log Name for Log Rotation string 32

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32039 - LOG_ID_VIEW_MEM_LOG_SUCC

Message ID: 32039

Message Description: LOG_ID_VIEW_MEM_LOG_SUCC
Message Meaning: Memory logs viewed successfully
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 430

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

log Log Name for Log Rotation string 32

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32040 - LOG_ID_REPORT_DELETED

Message ID: 32040

Message Description: LOG_ID_REPORT_DELETED
Message Meaning: Report deleted
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 431

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32041 - LOG_ID_REPORT_DELETED_GUI

Message ID: 32041

Message Description: LOG_ID_REPORT_DELETED_GUI
Message Meaning: Report deleted from GUI
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32042 - LOG_ID_MEM_LOG_SECOND_FULL

Message ID: 32042

Message Description: LOG_ID_MEM_LOG_SECOND_FULL
Message Meaning: Memory log full over second warning level
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 432

Fortinet, Inc.
Log Messages

Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32043 - LOG_ID_MEM_LOG_FINAL_FULL

Message ID: 32043

Message Description: LOG_ID_MEM_LOG_FINAL_FULL
Message Meaning: Memory log full over final warning level
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 433

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

32044 - LOG_ID_LOG_DELETE

Message ID: 32044

Message Description: LOG_ID_LOG_DELETE
Message Meaning: Log deleted by user
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

log Log Name for Log Rotation string 32

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32045 - LOG_ID_MGR_LIC_EXPIRE

Message ID: 32045

Message Description: LOG_ID_MGR_LIC_EXPIRE
Message Meaning: FortiGuard management service license expiring

FortiOS 6.0.10 Log Reference 434

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32046 - LOG_ID_SSL_CORRPUT_MAC

Message ID: 32046

Message Description: LOG_ID_SSL_CORRPUT_MAC
Message Meaning: SSL Message Authentication Code corrupted
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 435

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

vd Virtual Domain Name string 32

32048 - LOG_ID_SCHEDULE_EXPIRE

Message ID: 32048

Message Description: LOG_ID_SCHEDULE_EXPIRE
Message Meaning: One time schedule expiring
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32049 - LOG_ID_FC_EXPIRE

Message ID: 32049

Message Description: LOG_ID_FC_EXPIRE
Message Meaning: FortiCloud license expiring
Type: Event

FortiOS 6.0.10 Log Reference 436

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32050 - LOG_ID_POL_PKT_CAPTURE_FULL

Message ID: 32050

Message Description: LOG_ID_POL_PKT_CAPTURE_FULL
Message Meaning: Policy packet capture full
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 437

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

32051 - LOG_ID_LOG_UPLOAD

Message ID: 32051

Message Description: LOG_ID_LOG_UPLOAD
Message Meaning: Disk logs upload started
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

vd Virtual Domain Name string 32

32052 - LOG_ID_UPLOAD_RUN_SCRIPT

Message ID: 32052

Message Description: LOG_ID_UPLOAD_RUN_SCRIPT
Message Meaning: Upload and run a script
Type: Event

FortiOS 6.0.10 Log Reference 438

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32053 - LOG_ID_ADMIN_MTNER_LOGIN_SUCC

Message ID: 32053

Message Description: LOG_ID_ADMIN_MTNER_LOGIN_SUCC
Message Meaning: Admin monitor login successful
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 439

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

method string 64

msg Message Text string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32054 - LOG_ID_ADMIN_MTNER_LOGOUT

Message ID: 32054

Message Description: LOG_ID_ADMIN_MTNER_LOGOUT
Message Meaning: Admin monitor logout successful
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 440

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

method string 64

msg Message Text string

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

state string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32055 - LOG_ID_FDS_QUOTA_WARN_WARNING

Message ID: 32055

Message Description: LOG_ID_FDS_QUOTA_WARN_WARNING
Message Meaning: FortiCloud quota full second warning
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 441

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32056 - LOG_ID_FDS_QUOTA_WARN_INFO

Message ID: 32056

Message Description: LOG_ID_FDS_QUOTA_WARN_INFO
Message Meaning: FortiCloud quota full first warning
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32057 - LOG_ID_VIEW_FAZ_LOG_FAIL

Message ID: 32057

Message Description: LOG_ID_VIEW_FAZ_LOG_FAIL
Message Meaning: FortiAnalyzer log access failed
Type: Event

FortiOS 6.0.10 Log Reference 442

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32058 - LOG_ID_VIEW_FAZ_LOG_SUCC

Message ID: 32058

Message Description: LOG_ID_VIEW_FAZ_LOG_SUCC
Message Meaning: FortiAnalyzer logs viewed successfully
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 443

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32095 - LOG_ID_GUI_CHG_SUB_MODULE

Message ID: 32095

Message Description: LOG_ID_GUI_CHG_SUB_MODULE
Message Meaning: Admin performed an action from GUI
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 444

Fortinet, Inc.
Log Messages

32097 - LOG_ID_DELETE_CAPTURE_PKT

Message ID: 32097

Message Description: LOG_ID_DELETE_CAPTURE_PKT
Message Meaning: Policy packet capture file deleted
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32100 - LOG_ID_FORTI_TOKEN_SYNC

Message ID: 32100

Message Description: LOG_ID_FORTI_TOKEN_SYNC
Message Meaning: FortiToken synchronized
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 445

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32102 - LOG_ID_CHG_CONFIG

Message ID: 32102

Message Description: LOG_ID_CHG_CONFIG
Message Meaning: Configuration changed
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

module Configuration Module Name string 32

msg Message Text string

FortiOS 6.0.10 Log Reference 446

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

submodule Configuration Sub-Module Name string 32

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32103 - LOG_ID_NEW_FIRMWARE

Message ID: 32103

Message Description: LOG_ID_NEW_FIRMWARE
Message Meaning: New firmware available on FortiGuard
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 447

Fortinet, Inc.
Log Messages

32104 - LOG_ID_CHG_CONFIG_GUI

Message ID: 32104

Message Description: LOG_ID_CHG_CONFIG_GUI
Message Meaning: Configuration changed via GUI
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

module Configuration Module Name string 32

msg Message Text string

submodule Configuration Sub-Module Name string 32

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32105 - LOG_ID_NTP_SVR_STAUS_CHG_REACHABLE

Message ID: 32105

Message Description: LOG_ID_NTP_SVR_STAUS_CHG_REACHABLE
Message Meaning: NTP server status changes to reachable
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 448

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32106 - LOG_ID_NTP_SVR_STAUS_CHG_RESOLVABLE

Message ID: 32106

Message Description: LOG_ID_NTP_SVR_STAUS_CHG_RESOLVABLE
Message Meaning: NTP server status changes to resolvable
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 449

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32107 - LOG_ID_NTP_SVR_STAUS_CHG_UNRESOLVABLE

Message ID: 32107

Message Description: LOG_ID_NTP_SVR_STAUS_CHG_UNRESOLVABLE
Message Meaning: NTP server status changes to unresolvable
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 450

Fortinet, Inc.
Log Messages

32108 - LOG_ID_NTP_SVR_STAUS_CHG_UNREACHABLE

Message ID: 32108

Message Description: LOG_ID_NTP_SVR_STAUS_CHG_UNREACHABLE
Message Meaning: NTP server status changes to unreachable
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32109 - LOG_ID_UPD_SIGN_AV_DB

Message ID: 32109

Message Description: LOG_ID_UPD_SIGN_AV_DB
Message Meaning: Updating virus database
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 451

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32110 - LOG_ID_UPD_SIGN_IPS_DB

Message ID: 32110

Message Description: LOG_ID_UPD_SIGN_IPS_DB
Message Meaning: IPS database updated
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 452

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32111 - LOG_ID_UPD_SIGN_AVIPS_DB

Message ID: 32111

Message Description: LOG_ID_UPD_SIGN_AVIPS_DB
Message Meaning: Virus and IPS database updated
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 453

Fortinet, Inc.
Log Messages

32113 - LOG_ID_UPD_SIGN_SRCVIS_DB

Message ID: 32113

Message Description: LOG_ID_UPD_SIGN_SRCVIS_DB
Message Meaning: SRC-VIS object updated
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32114 - LOG_ID_UPD_SIGN_GEOIP_DB

Message ID: 32114

Message Description: LOG_ID_UPD_SIGN_GEOIP_DB
Message Meaning: GeoIP object updated
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 454

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32116 - LOG_ID_UPD_SIGN_AVPKG_FAILURE

Message ID: 32116

Message Description: LOG_ID_UPD_SIGN_AVPKG_FAILURE
Message Meaning: AV package update by SCP failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 455

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32117 - LOG_ID_UPD_SIGN_AVPKG_SUCCESS

Message ID: 32117

Message Description: LOG_ID_UPD_SIGN_AVPKG_SUCCESS
Message Meaning: AV package update by SCP successful
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 456

Fortinet, Inc.
Log Messages

32118 - LOG_ID_UPD_ADMIN_AV_DB

Message ID: 32118

Message Description: LOG_ID_UPD_ADMIN_AV_DB
Message Meaning: AV updated by admin
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32119 - LOG_ID_UPD_SCANUNIT_AV_DB

Message ID: 32119

Message Description: LOG_ID_UPD_SCANUNIT_AV_DB
Message Meaning: AV database updated by scanunit
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 457

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32120 - LOG_ID_RPT_ADD_DATASET

Message ID: 32120

Message Description: LOG_ID_RPT_ADD_DATASET
Message Meaning: Report data set added
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 458

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32122 - LOG_ID_RPT_DEL_DATASET

Message ID: 32122

Message Description: LOG_ID_RPT_DEL_DATASET
Message Meaning: Report data set deleted
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32125 - LOG_ID_RPT_ADD_CHART

Message ID: 32125

FortiOS 6.0.10 Log Reference 459

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_RPT_ADD_CHART

Message Meaning: Report chart widget added
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32126 - LOG_ID_RPT_DEL_CHART

Message ID: 32126

Message Description: LOG_ID_RPT_DEL_CHART
Message Meaning: Report chart widget deleted
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 460

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32129 - LOG_ID_ADD_GUEST

Message ID: 32129

Message Description: LOG_ID_ADD_GUEST
Message Meaning: Guest user added
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

FortiOS 6.0.10 Log Reference 461

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32130 - LOG_ID_CHG_USER

Message ID: 32130

Message Description: LOG_ID_CHG_USER
Message Meaning: User changed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

new_status New Status string 512

old_status Original Status string 512

passwd Password string 20

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 462

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32131 - LOG_ID_DEL_GUEST

Message ID: 32131

Message Description: LOG_ID_DEL_GUEST
Message Meaning: Guest user deleted
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32132 - LOG_ID_ADD_USER

Message ID: 32132

Message Description: LOG_ID_ADD_USER
Message Meaning: Local user added

FortiOS 6.0.10 Log Reference 463

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32138 - LOG_ID_REBOOT

Message ID: 32138

Message Description: LOG_ID_REBOOT
Message Meaning: Device rebooted
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 464

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32140 - LOG_ID_TIME_USER_SETTING_CHG

Message ID: 32140

Message Description: LOG_ID_TIME_USER_SETTING_CHG
Message Meaning: Global time setting changed by user
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

srcip Source IP ip 39

FortiOS 6.0.10 Log Reference 465

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32141 - LOG_ID_TIME_NTP_SETTING_CHG

Message ID: 32141

Message Description: LOG_ID_TIME_NTP_SETTING_CHG
Message Meaning: Global time setting changed by NTP
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 466

Fortinet, Inc.
Log Messages

32142 - LOG_ID_BACKUP_CONF

Message ID: 32142

Message Description: LOG_ID_BACKUP_CONF
Message Meaning: System configuration backed up
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32143 - LOG_ID_BACKUP_CONF_BY_SCP

Message ID: 32143

Message Description: LOG_ID_BACKUP_CONF_BY_SCP
Message Meaning: System configuration backed up by SCP
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 467

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32144 - LOG_ID_BACKUP_CONF_ERROR

Message ID: 32144

Message Description: LOG_ID_BACKUP_CONF_ERROR
Message Meaning: System configuration backed up error
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 468

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32145 - LOG_ID_BACKUP_CONF_ALERT

Message ID: 32145

Message Description: LOG_ID_BACKUP_CONF_ALERT
Message Meaning: System configuration backed up alert
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 469

Fortinet, Inc.
Log Messages

32148 - LOG_ID_GET_CRL

Message ID: 32148

Message Description: LOG_ID_GET_CRL
Message Meaning: CRL update requested
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

crl string

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32149 - LOG_ID_COMMAND_FAIL

Message ID: 32149

Message Description: LOG_ID_COMMAND_FAIL
Message Meaning: Command failed
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 470

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32151 - LOG_ID_ADD_IP6_LOCAL_POL

Message ID: 32151

Message Description: LOG_ID_ADD_IP6_LOCAL_POL
Message Meaning: IPv6 firewall local in policy added
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

act string 16

daddr string 80

date Date string 10

devid Device ID string 16

dintf string 36

eventtime uint64 20

iptype string 16

level Log Level string 11

FortiOS 6.0.10 Log Reference 471

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32152 - LOG_ID_CHG_IP6_LOCAL_POL

Message ID: 32152

Message Description: LOG_ID_CHG_IP6_LOCAL_POL
Message Meaning: IPv6 firewall local in policy setting changed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

act string 16

daddr string 80

date Date string 10

devid Device ID string 16

dintf string 36

eventtime uint64 20

iptype string 16

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 472

Fortinet, Inc.
Log Messages

32153 - LOG_ID_DEL_IP6_LOCAL_POL

Message ID: 32153

Message Description: LOG_ID_DEL_IP6_LOCAL_POL
Message Meaning: IPv6 firewall local in policy deleted
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

act string 16

daddr string 80

date Date string 10

devid Device ID string 16

dintf string 36

eventtime uint64 20

iptype string 16

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32155 - LOG_ID_ACT_FTOKEN_REQ

Message ID: 32155

Message Description: LOG_ID_ACT_FTOKEN_REQ
Message Meaning: FortiToken activation requested
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 473

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

serialno Serial Number string 16

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32156 - LOG_ID_ACT_FTOKEN_SUCC

Message ID: 32156

Message Description: LOG_ID_ACT_FTOKEN_SUCC
Message Meaning: FortiToken activation successful
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 474

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

serialno Serial Number string 16

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32157 - LOG_ID_SYNC_FTOKEN_SUCC

Message ID: 32157

Message Description: LOG_ID_SYNC_FTOKEN_SUCC
Message Meaning: FortiToken re-synchronized
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

serialno Serial Number string 16

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 475

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32158 - LOG_ID_SYNC_FTOKEN_FAIL

Message ID: 32158

Message Description: LOG_ID_SYNC_FTOKEN_FAIL
Message Meaning: FortiToken re-synchronization failed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

serialno Serial Number string 16

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32159 - LOG_ID_ACT_FTOKEN_FAIL

Message ID: 32159

FortiOS 6.0.10 Log Reference 476

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_ACT_FTOKEN_FAIL

Message Meaning: FortiToken activation failed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

serialno Serial Number string 16

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32160 - LOG_ID_FTM_PUSH_SUCC

Message ID: 32160

Message Description: LOG_ID_FTM_PUSH_SUCC
Message Meaning: FortiToken mobile push message succeeded
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 477

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32161 - LOG_ID_FTM_PUSH_FAIL

Message ID: 32161

Message Description: LOG_ID_FTM_PUSH_FAIL
Message Meaning: FortiToken mobile push message failed
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 478

Fortinet, Inc.
Log Messages

32168 - LOG_ID_REACH_VDOM_LIMIT

Message ID: 32168

Message Description: LOG_ID_REACH_VDOM_LIMIT
Message Meaning: VDOM limit reached
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32169 - LOG_ID_ALARM_DLP_DB

Message ID: 32169

Message Description: LOG_ID_ALARM_DLP_DB
Message Meaning: DLP database space alarm
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 479

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32170 - LOG_ID_ALARM_MSG

Message ID: 32170

Message Description: LOG_ID_ALARM_MSG
Message Meaning: Alarm created
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

alarmid Alarm ID uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

groupid User Group ID uint32 10

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 480

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32171 - LOG_ID_ALARM_ACK

Message ID: 32171

Message Description: LOG_ID_ALARM_ACK
Message Meaning: Alarm acknowledged
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

acktime Alarm Acknowledge Time string 24

action Action string 32

alarmid Alarm ID uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 481

Fortinet, Inc.
Log Messages

32172 - LOG_ID_ADD_IP4_LOCAL_POL

Message ID: 32172

Message Description: LOG_ID_ADD_IP4_LOCAL_POL
Message Meaning: IPv4 firewall local in policy added
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

act string 16

daddr string 80

date Date string 10

devid Device ID string 16

dintf string 36

eventtime uint64 20

iptype string 16

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32173 - LOG_ID_CHG_IP4_LOCAL_POL

Message ID: 32173

Message Description: LOG_ID_CHG_IP4_LOCAL_POL
Message Meaning: IPv4 firewall local in policy's setting changed
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 482

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

act string 16

daddr string 80

date Date string 10

devid Device ID string 16

dintf string 36

eventtime uint64 20

iptype string 16

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32174 - LOG_ID_DEL_IP4_LOCAL_POL

Message ID: 32174

Message Description: LOG_ID_DEL_IP4_LOCAL_POL
Message Meaning: IPv4 firewall local in policy deleted
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

act string 16

daddr string 80

date Date string 10

devid Device ID string 16

dintf string 36

eventtime uint64 20

iptype string 16

FortiOS 6.0.10 Log Reference 483

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32190 - LOG_ID_UPT_INVALID_IMG

Message ID: 32190

Message Description: LOG_ID_UPT_INVALID_IMG
Message Meaning: Invalid image loaded
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 484

Fortinet, Inc.
Log Messages

32191 - LOG_ID_UPT_INVALID_IMG_CC

Message ID: 32191

Message Description: LOG_ID_UPT_INVALID_IMG_CC
Message Meaning: Image with invalid CC signature loaded
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32192 - LOG_ID_UPT_INVALID_IMG_RSA

Message ID: 32192

Message Description: LOG_ID_UPT_INVALID_IMG_RSA
Message Meaning: Image with invalid RSA signature loaded
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 485

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32193 - LOG_ID_UPT_IMG_RSA

Message ID: 32193

Message Description: LOG_ID_UPT_IMG_RSA
Message Meaning: Image with valid RSA signature loaded
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 486

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32194 - LOG_ID_UPT_IMG_FAIL

Message ID: 32194

Message Description: LOG_ID_UPT_IMG_FAIL
Message Meaning: System upgrade failed due to file operation failure
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 487

Fortinet, Inc.
Log Messages

32199 - LOG_ID_RESTORE_IMG_USB

Message ID: 32199

Message Description: LOG_ID_RESTORE_IMG_USB
Message Meaning: Image restored from USB
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32200 - LOG_ID_SHUTDOWN

Message ID: 32200

Message Description: LOG_ID_SHUTDOWN
Message Meaning: Device shutdown
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 488

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32201 - LOG_ID_LOAD_IMG_SUCC

Message ID: 32201

Message Description: LOG_ID_LOAD_IMG_SUCC
Message Meaning: Image loaded successfully
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 489

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32202 - LOG_ID_RESTORE_IMG

Message ID: 32202

Message Description: LOG_ID_RESTORE_IMG
Message Meaning: Image restored
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 490

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32203 - LOG_ID_RESTORE_CONF

Message ID: 32203

Message Description: LOG_ID_RESTORE_CONF
Message Meaning: Configuration restored
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32204 - LOG_ID_RESTORE_FGD_SVR

Message ID: 32204

Message Description: LOG_ID_RESTORE_FGD_SVR
Message Meaning: FortiGuard service restored
Type: Event

FortiOS 6.0.10 Log Reference 491

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32205 - LOG_ID_RESTORE_VDOM_LIC

Message ID: 32205

Message Description: LOG_ID_RESTORE_VDOM_LIC
Message Meaning: VM license restored
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 492

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32206 - LOG_ID_RESTORE_SCRIPT

Message ID: 32206

Message Description: LOG_ID_RESTORE_SCRIPT
Message Meaning: Script restored from management station
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 493

Fortinet, Inc.
Log Messages

32207 - LOG_ID_RETRIEVE_CONF_LIST

Message ID: 32207

Message Description: LOG_ID_RETRIEVE_CONF_LIST
Message Meaning: Configuration list retrieval failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32208 - LOG_ID_IMP_PKCS12_CERT

Message ID: 32208

Message Description: LOG_ID_IMP_PKCS12_CERT
Message Meaning: PKCS12 certificate imported
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 494

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32209 - LOG_ID_RESTORE_USR_DEF_IPS

Message ID: 32209

Message Description: LOG_ID_RESTORE_USR_DEF_IPS
Message Meaning: IPS custom signatures restored
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 495

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32210 - LOG_ID_BACKUP_IMG_SUCC

Message ID: 32210

Message Description: LOG_ID_BACKUP_IMG_SUCC
Message Meaning: Firmware image backed up successfully
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 496

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32211 - LOG_ID_UPLOAD_REVISION

Message ID: 32211

Message Description: LOG_ID_UPLOAD_REVISION
Message Meaning: Revision uploaded to flash disk
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32212 - LOG_ID_DEL_REVISION

Message ID: 32212

Message Description: LOG_ID_DEL_REVISION
Message Meaning: Revision deleted

FortiOS 6.0.10 Log Reference 497

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32213 - LOG_ID_RESTORE_TEMPLATE

Message ID: 32213

Message Description: LOG_ID_RESTORE_TEMPLATE
Message Meaning: Template restored
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 498

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32214 - LOG_ID_RESTORE_FILE

Message ID: 32214

Message Description: LOG_ID_RESTORE_FILE
Message Meaning: File restore failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 499

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32215 - LOG_ID_UPT_IMG

Message ID: 32215

Message Description: LOG_ID_UPT_IMG
Message Meaning: Image updated
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32217 - LOG_ID_UPD_IPS

Message ID: 32217

Message Description: LOG_ID_UPD_IPS
Message Meaning: IPS package - Admin update successful
Type: Event

FortiOS 6.0.10 Log Reference 500

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32218 - LOG_ID_UPD_DLP

Message ID: 32218

Message Description: LOG_ID_UPD_DLP
Message Meaning: DLP fingerprint database update via SCP failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 501

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32219 - LOG_ID_BACKUP_OUTPUT

Message ID: 32219

Message Description: LOG_ID_BACKUP_OUTPUT
Message Meaning: Error output backup via SCP successful
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 502

Fortinet, Inc.
Log Messages

32220 - LOG_ID_BACKUP_COMMAND

Message ID: 32220

Message Description: LOG_ID_BACKUP_COMMAND
Message Meaning: Batch mode command output backup via SCP successful
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32221 - LOG_ID_UPD_VDOM_LIC

Message ID: 32221

Message Description: LOG_ID_UPD_VDOM_LIC
Message Meaning: VM license installed via SCP
Type: Event
Category: SYSTEM
Severity: Warning

FortiOS 6.0.10 Log Reference 503

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32222 - LOG_ID_GLB_SETTING_CHG

Message ID: 32222

Message Description: LOG_ID_GLB_SETTING_CHG
Message Meaning: Global setting changed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

field string 32

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 504

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

new_value New Virtual Domain Name string 128

old_value Original Virtual Domain name string 128

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32223 - LOG_ID_BACKUP_USER_DEF_IPS

Message ID: 32223

Message Description: LOG_ID_BACKUP_USER_DEF_IPS
Message Meaning: IPS custom signatures backup success
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 505

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32224 - LOG_ID_BACKUP_DISK_LOG

Message ID: 32224

Message Description: LOG_ID_BACKUP_DISK_LOG
Message Meaning: Disk logs backed up
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

file File Name for Generated Report? string 256

hash Hash Value of Downloaded File string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 506

Fortinet, Inc.
Log Messages

32225 - LOG_ID_DEL_ALL_REVISION

Message ID: 32225

Message Description: LOG_ID_DEL_ALL_REVISION
Message Meaning: Revision database reset due to data corruption
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32226 - LOG_ID_LOAD_IMG_FAIL

Message ID: 32226

Message Description: LOG_ID_LOAD_IMG_FAIL
Message Meaning: Image failed to load
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 507

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32227 - LOG_ID_UPD_DLP_FAIL

Message ID: 32227

Message Description: LOG_ID_UPD_DLP_FAIL
Message Meaning: DLP fingerprint database failed to update by SCP
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 508

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32228 - LOG_ID_LOAD_IMG_FAIL_WRONG_IMG

Message ID: 32228

Message Description: LOG_ID_LOAD_IMG_FAIL_WRONG_IMG
Message Meaning: Firmware image loaded incorrect
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 509

Fortinet, Inc.
Log Messages

32229 - LOG_ID_LOAD_IMG_FAIL_NO_RSA

Message ID: 32229

Message Description: LOG_ID_LOAD_IMG_FAIL_NO_RSA
Message Meaning: Firmware image without valid RSA signature loaded
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32230 - LOG_ID_LOAD_IMG_FAIL_INVALID_RSA

Message ID: 32230

Message Description: LOG_ID_LOAD_IMG_FAIL_INVALID_RSA
Message Meaning: Firmware image with invalid RSA signature loaded
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 510

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32231 - LOG_ID_RESTORE_FGD_SVR_FAIL

Message ID: 32231

Message Description: LOG_ID_RESTORE_FGD_SVR_FAIL
Message Meaning: FortiGuard service failed to restore
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 511

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32232 - LOG_ID_RESTORE_VDOM_LIC_FAIL

Message ID: 32232

Message Description: LOG_ID_RESTORE_VDOM_LIC_FAIL
Message Meaning: VM license failed to restore
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32233 - LOG_ID_BACKUP_IMG_FAIL

Message ID: 32233

FortiOS 6.0.10 Log Reference 512

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_BACKUP_IMG_FAIL

Message Meaning: Firmware image backup failed
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32234 - LOG_ID_RESTORE_IMG_INVALID_CC

Message ID: 32234

Message Description: LOG_ID_RESTORE_IMG_INVALID_CC
Message Meaning: Image with invalid CC signature restored
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 513

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32235 - LOG_ID_RESTORE_IMG_FORTIGUARD

Message ID: 32235

Message Description: LOG_ID_RESTORE_IMG_FORTIGUARD
Message Meaning: Image restored from FortiGuard Management
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 514

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

32236 - LOG_ID_BACKUP_MEM_LOG

Message ID: 32236

Message Description: LOG_ID_BACKUP_MEM_LOG
Message Meaning: Memory logs backed up
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32237 - LOG_ID_BACKUP_MEM_LOG_FAIL

Message ID: 32237

Message Description: LOG_ID_BACKUP_MEM_LOG_FAIL

FortiOS 6.0.10 Log Reference 515

Fortinet, Inc.
Log Messages

Message Meaning: Memory logs failed to back up

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32238 - LOG_ID_BACKUP_DISK_LOG_FAIL

Message ID: 32238

Message Description: LOG_ID_BACKUP_DISK_LOG_FAIL
Message Meaning: Disk logs failed to back up
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 516

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32239 - LOG_ID_BACKUP_DISK_LOG_USB

Message ID: 32239

Message Description: LOG_ID_BACKUP_DISK_LOG_USB
Message Meaning: Disk logs backed up to USB
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 517

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32240 - LOG_ID_SYS_USB_MODE

Message ID: 32240

Message Description: LOG_ID_SYS_USB_MODE
Message Meaning: System operating in USB mode
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32241 - LOG_ID_BACKUP_DISK_LOG_USB_FAIL

Message ID: 32241

Message Description: LOG_ID_BACKUP_DISK_LOG_USB_FAIL
Message Meaning: Disk logs failed to back up to USB

FortiOS 6.0.10 Log Reference 518

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32242 - LOG_ID_UPD_VDOM_LIC_FAIL

Message ID: 32242

Message Description: LOG_ID_UPD_VDOM_LIC_FAIL
Message Meaning: VM license failed to install via SCP
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 519

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32243 - LOG_ID_UPD_IPS_SCP

Message ID: 32243

Message Description: LOG_ID_UPD_IPS_SCP
Message Meaning: IPS package updated via SCP
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 520

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32244 - LOG_ID_UPD_IPS_SCP_FAIL

Message ID: 32244

Message Description: LOG_ID_UPD_IPS_SCP_FAIL
Message Meaning: IPS package failed to update via SCP
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32245 - LOG_ID_BACKUP_USER_DEF_IPS_FAIL

Message ID: 32245

Message Description: LOG_ID_BACKUP_USER_DEF_IPS_FAIL
Message Meaning: IPS custom signatures backup failed

FortiOS 6.0.10 Log Reference 521

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32246 - LOG_ID_RESTORE_USR_DEF_IPS_CRITICAL

Message ID: 32246

Message Description: LOG_ID_RESTORE_USR_DEF_IPS_CRITICAL
Message Meaning: IPS custom signatures restored critical
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 522

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32247 - LOG_ID_SSH_NEGOTIATION_FAILURE

Message ID: 32247

Message Description: LOG_ID_SSH_NEGOTIATION_FAILURE
Message Meaning: SSH protocol cannot be negotiated
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

addr IP Address string 80

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

FortiOS 6.0.10 Log Reference 523

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32252 - LOG_ID_FACTORY_RESET

Message ID: 32252

Message Description: LOG_ID_FACTORY_RESET
Message Meaning: Factory settings reset
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32253 - LOG_ID_FORMAT_RAID

Message ID: 32253

Message Description: LOG_ID_FORMAT_RAID

FortiOS 6.0.10 Log Reference 524

Fortinet, Inc.
Log Messages

Message Meaning: RAID disk formatted

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32254 - LOG_ID_ENABLE_RAID

Message ID: 32254

Message Description: LOG_ID_ENABLE_RAID
Message Meaning: RAID enabled
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 525

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32255 - LOG_ID_DISABLE_RAID

Message ID: 32255

Message Description: LOG_ID_DISABLE_RAID
Message Meaning: RAID disabled
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 526

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32300 - LOG_ID_UPLOAD_RPT_IMG

Message ID: 32300

Message Description: LOG_ID_UPLOAD_RPT_IMG
Message Meaning: Report image file uploaded
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 527

Fortinet, Inc.
Log Messages

32301 - LOG_ID_ADD_VDOM

Message ID: 32301

Message Description: LOG_ID_ADD_VDOM
Message Meaning: VDOM added
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32302 - LOG_ID_DEL_VDOM

Message ID: 32302

Message Description: LOG_ID_DEL_VDOM
Message Meaning: VDOM deleted
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 528

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32545 - LOG_ID_SYS_RESTART

Message ID: 32545

Message Description: LOG_ID_SYS_RESTART
Message Meaning: Scheduled daily reboot started
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 529

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32546 - LOG_ID_APPLICATION_CRASH

Message ID: 32546

Message Description: LOG_ID_APPLICATION_CRASH
Message Meaning: Application crashed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32547 - LOG_ID_AUTOSCRIPT_START

Message ID: 32547

FortiOS 6.0.10 Log Reference 530

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_AUTOSCRIPT_START

Message Meaning: Autoscript start
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32548 - LOG_ID_AUTOSCRIPT_STOP

Message ID: 32548

Message Description: LOG_ID_AUTOSCRIPT_STOP
Message Meaning: Autoscript stop
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 531

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32549 - LOG_ID_AUTOSCRIPT_STOP_AUTO

Message ID: 32549

Message Description: LOG_ID_AUTOSCRIPT_STOP_AUTO
Message Meaning: Autoscript stop automatically
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 532

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

32550 - LOG_ID_AUTOSCRIPT_DELETE_RSLT

Message ID: 32550

Message Description: LOG_ID_AUTOSCRIPT_DELETE_RSLT
Message Meaning: Autoscript delete result
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32551 - LOG_ID_AUTOSCRIPT_BACKUP_RSLT

Message ID: 32551

Message Description: LOG_ID_AUTOSCRIPT_BACKUP_RSLT
Message Meaning: Autoscript backup result
Type: Event

FortiOS 6.0.10 Log Reference 533

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32552 - LOG_ID_AUTOSCRIPT_CHECK_STATUS

Message ID: 32552

Message Description: LOG_ID_AUTOSCRIPT_CHECK_STATUS
Message Meaning: Autoscript check status
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 534

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32553 - LOG_ID_AUTOSCRIPT_STOP_REACH_LIMIT

Message ID: 32553

Message Description: LOG_ID_AUTOSCRIPT_STOP_REACH_LIMIT
Message Meaning: Autoscript stop due to limit reached
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32561 - LOG_ID_ADMIN_LOGOUT_DISCONNECT

Message ID: 32561

FortiOS 6.0.10 Log Reference 535

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_ADMIN_LOGOUT_DISCONNECT

Message Meaning: Admin disconnected
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method string 64

msg Message Text string

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

state string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32562 - LOG_ID_STORE_CONF_FAIL_SPACE

Message ID: 32562

Message Description: LOG_ID_STORE_CONF_FAIL_SPACE
Message Meaning: Store config failed - not enough flash space

FortiOS 6.0.10 Log Reference 536

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32564 - LOG_ID_RESTORE_CONF_FAIL

Message ID: 32564

Message Description: LOG_ID_RESTORE_CONF_FAIL
Message Meaning: Configuration failed to restore
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 537

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32565 - LOG_ID_RESTORE_CONF_BY_MGMT

Message ID: 32565

Message Description: LOG_ID_RESTORE_CONF_BY_MGMT
Message Meaning: Configuration restored from management station
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 538

Fortinet, Inc.
Log Messages

32566 - LOG_ID_RESTORE_CONF_BY_SCP

Message ID: 32566

Message Description: LOG_ID_RESTORE_CONF_BY_SCP
Message Meaning: Configuration restored by SCP
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32567 - LOG_ID_RESTORE_CONF_BY_USB

Message ID: 32567

Message Description: LOG_ID_RESTORE_CONF_BY_USB
Message Meaning: Configuration restored by USB
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 539

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32568 - LOG_ID_DEL_REVISION_DB

Message ID: 32568

Message Description: LOG_ID_DEL_REVISION_DB
Message Meaning: Revision Database deletion
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 540

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

32569 - LOG_ID_FSW_SWITCH_LOG_EVENT

Message ID: 32569

Message Description: LOG_ID_FSW_SWITCH_LOG_EVENT
Message Meaning: Switch-Controller
Type: Event
Category: SYSTEM
Severity: Unknown

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 541

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32570 - LOG_ID_ADMIN_MTNER_LOGOUT_DISCONNECT

Message ID: 32570

Message Description: LOG_ID_ADMIN_MTNER_LOGOUT_DISCONNECT
Message Meaning: Admin monitor disconnected
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method string 64

msg Message Text string

reason Reason string 256

sn Serial Number string 64

srcip Source IP ip 39

state string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 542

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32601 - LOG_ID_FGT_SWITCH_LOG_DISCOVER

Message ID: 32601

Message Description: LOG_ID_FGT_SWITCH_LOG_DISCOVER
Message Meaning: Switch-Controller discovered
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32602 - LOG_ID_FGT_SWITCH_LOG_AUTH

Message ID: 32602

Message Description: LOG_ID_FGT_SWITCH_LOG_AUTH
Message Meaning: Switch-Controller authorized
Type: Event

FortiOS 6.0.10 Log Reference 543

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32603 - LOG_ID_FGT_SWITCH_LOG_DEAUTH

Message ID: 32603

Message Description: LOG_ID_FGT_SWITCH_LOG_DEAUTH
Message Meaning: Switch-Controller deauthorized
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 544

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32604 - LOG_ID_FGT_SWITCH_LOG_DELETE

Message ID: 32604

Message Description: LOG_ID_FGT_SWITCH_LOG_DELETE
Message Meaning: Switch-Controller deleted
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32605 - LOG_ID_FGT_SWITCH_LOG_TUNNEL_UP

Message ID: 32605

FortiOS 6.0.10 Log Reference 545

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_FGT_SWITCH_LOG_TUNNEL_UP

Message Meaning: Switch-Controller Tunnel Up
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32606 - LOG_ID_FGT_SWITCH_LOG_TUNNEL_DOWN

Message ID: 32606

Message Description: LOG_ID_FGT_SWITCH_LOG_TUNNEL_DOWN
Message Meaning: Switch-Controller Tunnel Down
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 546

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32607 - LOG_ID_FGT_SWITCH_PUSH_IMAGE

Message ID: 32607

Message Description: LOG_ID_FGT_SWITCH_PUSH_IMAGE
Message Meaning: Image push to FortiSwitch
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 547

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32608 - LOG_ID_FGT_SWITCH_STAGE_IMAGE

Message ID: 32608

Message Description: LOG_ID_FGT_SWITCH_STAGE_IMAGE
Message Meaning: Image stage to FortiSwitch
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32609 - LOG_ID_FGT_SWITCH_DISABLE_DISCOVERY

Message ID: 32609

Message Description: LOG_ID_FGT_SWITCH_DISABLE_DISCOVERY
Message Meaning: Disable FortiSwitch Discovery
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 548

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32610 - LOG_ID_FGT_SWITCH_LOG_WARNING

Message ID: 32610

Message Description: LOG_ID_FGT_SWITCH_LOG_WARNING
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 549

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32693 - LOG_ID_FGT_SWITCH_GROUP_SWC

Message ID: 32693

Message Description: LOG_ID_FGT_SWITCH_GROUP_SWC
Message Meaning: FortiSwitch switch controller
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

FortiOS 6.0.10 Log Reference 550

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

32694 - LOG_ID_FGT_SWITCH_GROUP_POE

Message ID: 32694

Message Description: LOG_ID_FGT_SWITCH_GROUP_POE
Message Meaning: FortiSwitch PoE
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32695 - LOG_ID_FGT_SWITCH_GROUP_LINK

Message ID: 32695

FortiOS 6.0.10 Log Reference 551

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_FGT_SWITCH_GROUP_LINK

Message Meaning: FortiSwitch link
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32696 - LOG_ID_FGT_SWITCH_GROUP_STP

Message ID: 32696

Message Description: LOG_ID_FGT_SWITCH_GROUP_STP
Message Meaning: FortiSwitch spanning Tree
Type: Event
Category: SYSTEM
Severity: Critical

FortiOS 6.0.10 Log Reference 552

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32697 - LOG_ID_FGT_SWITCH_GROUP_SWITCH

Message ID: 32697

Message Description: LOG_ID_FGT_SWITCH_GROUP_SWITCH
Message Meaning: FortiSwitch switch
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

FortiOS 6.0.10 Log Reference 553

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32698 - LOG_ID_FGT_SWITCH_GROUP_ROUTER

Message ID: 32698

Message Description: LOG_ID_FGT_SWITCH_GROUP_ROUTER
Message Meaning: FortiSwitch router
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 554

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

32699 - LOG_ID_FGT_SWITCH_GROUP_SYSTEM

Message ID: 32699

Message Description: LOG_ID_FGT_SWITCH_GROUP_SYSTEM
Message Meaning: FortiSwitch system
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 555

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

35001 - LOG_ID_HA_SYNC_VIRDB

Message ID: 35001

Message Description: LOG_ID_HA_SYNC_VIRDB
Message Meaning: HA slave synchronized Virus database
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35002 - LOG_ID_HA_SYNC_ETDB

Message ID: 35002

Message Description: LOG_ID_HA_SYNC_ETDB
Message Meaning: HA slave synchronized Extended database
Type: Event

FortiOS 6.0.10 Log Reference 556

Fortinet, Inc.
Log Messages

Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35003 - LOG_ID_HA_SYNC_EXDB

Message ID: 35003

Message Description: LOG_ID_HA_SYNC_EXDB
Message Meaning: HA slave synchronized Extreme database
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 557

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

35004 - LOG_ID_HA_SYNC_FLDB

Message ID: 35004

Message Description: LOG_ID_HA_SYNC_FLDB
Message Meaning: HA slave synchronized FLDB
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35005 - LOG_ID_HA_SYNC_IPS

Message ID: 35005

Message Description: LOG_ID_HA_SYNC_IPS
Message Meaning: HA slave synchronized IDS package
Type: Event
Category: HA
Severity: Notice

FortiOS 6.0.10 Log Reference 558

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35007 - LOG_ID_HA_SYNC_AV

Message ID: 35007

Message Description: LOG_ID_HA_SYNC_AV
Message Meaning: HA slave synchronized AntiVirus package
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 559

Fortinet, Inc.
Log Messages

35009 - LOG_ID_HA_SYNC_CID

Message ID: 35009

Message Description: LOG_ID_HA_SYNC_CID
Message Meaning: HA slave synchronized CID package
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35010 - LOG_ID_HA_SYNC_UWDB

Message ID: 35010

Message Description: LOG_ID_HA_SYNC_UWDB
Message Meaning: HA slave synchronization URL database
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 560

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35011 - LOG_ID_HA_SYNC_FAIL

Message ID: 35011

Message Description: LOG_ID_HA_SYNC_FAIL
Message Meaning: HA slave synchronization failed
Type: Event
Category: HA
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

35012 - LOG_ID_CONF_SYNC_FAIL

Message ID: 35012

FortiOS 6.0.10 Log Reference 561

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_CONF_SYNC_FAIL

Message Meaning: Slave sync failed
Type: Event
Category: HA
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

36880 - LOG_ID_EVENT_SYSTEM_MAC_HOST_STORE_LIMIT

Message ID: 36880

Message Description: LOG_ID_EVENT_SYSTEM_MAC_HOST_STORE_LIMIT
Message Meaning: Device detection storage limit reached
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 562

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

36881 - LOG_ID_EVENT_SYSTEM_CFG_REVERT

Message ID: 36881

Message Description: LOG_ID_EVENT_SYSTEM_CFG_REVERT
Message Meaning: Configuration reverted due to timeout
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

36882 - LOG_ID_EVENT_SYSTEM_CFG_MANUALLY_SAVED

Message ID: 36882

Message Description: LOG_ID_EVENT_SYSTEM_CFG_MANUALLY_SAVED
Message Meaning: Configuration manually saved

FortiOS 6.0.10 Log Reference 563

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

37120 - MESGID_NEG_GENERIC_P1_NOTIF

Message ID: 37120

Message Description: MESGID_NEG_GENERIC_P1_NOTIF
Message Meaning: Negotiate IPsec phase 1
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 564

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

peer_notif Peer Notification string 25

remip Remote IP ip 39

remport Remote Port uint16 5

result Result string 31

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37121 - MESGID_NEG_GENERIC_P1_ERROR

Message ID: 37121

Message Description: MESGID_NEG_GENERIC_P1_ERROR
Message Meaning: Negotiate IPsec phase 1
Type: Event
Category: VPN
Severity: Error

FortiOS 6.0.10 Log Reference 565

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

peer_notif Peer Notification string 25

remip Remote IP ip 39

remport Remote Port uint16 5

result Result string 31

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37122 - MESGID_NEG_GENERIC_P2_NOTIF

Message ID: 37122

Message Description: MESGID_NEG_GENERIC_P2_NOTIF

FortiOS 6.0.10 Log Reference 566

Fortinet, Inc.
Log Messages

Message Meaning: Negotiate IPsec phase 2

Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

espauth ESP Authentication string 17

esptransform ESP Transform string 21

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

role Role string 9

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

FortiOS 6.0.10 Log Reference 567

Fortinet, Inc.
Log Messages

37123 - MESGID_NEG_GENERIC_P2_ERROR

Message ID: 37123

Message Description: MESGID_NEG_GENERIC_P2_ERROR
Message Meaning: Negotiate IPsec phase 2
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

espauth ESP Authentication string 17

esptransform ESP Transform string 21

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

role Role string 9

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 568

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37124 - MESGID_NEG_I_P1_ERROR

Message ID: 37124

Message Description: MESGID_NEG_I_P1_ERROR
Message Meaning: IPsec phase 1 error
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

peer_notif Peer Notification string 25

reason Reason string 256

FortiOS 6.0.10 Log Reference 569

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

remip Remote IP ip 39

remport Remote Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37125 - MESGID_NEG_I_P2_ERROR

Message ID: 37125

Message Description: MESGID_NEG_I_P2_ERROR
Message Meaning: IPsec phase 2 error
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

FortiOS 6.0.10 Log Reference 570

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

reason Reason string 256

remip Remote IP ip 39

remport Remote Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37126 - MESGID_NEG_NO_STATE_ERROR

Message ID: 37126

Message Description: MESGID_NEG_NO_STATE_ERROR
Message Meaning: IPsec no state error
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 571

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

reason Reason string 256

remip Remote IP ip 39

remport Remote Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37127 - MESGID_NEG_PROGRESS_P1_NOTIF

Message ID: 37127

Message Description: MESGID_NEG_PROGRESS_P1_NOTIF
Message Meaning: Progress IPsec phase 1
Type: Event
Category: VPN
Severity: Notice

FortiOS 6.0.10 Log Reference 572

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

dir Direction string 8

eventtime uint64 20

exch string 14

group User Group Name string 64

init string 6

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

mode Mode string 12

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

result Result string 31

role Role string 9

stage uint8 3

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

version string 64

FortiOS 6.0.10 Log Reference 573

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37128 - MESGID_NEG_PROGRESS_P1_ERROR

Message ID: 37128

Message Description: MESGID_NEG_PROGRESS_P1_ERROR
Message Meaning: Progress IPsec phase 1
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

dir Direction string 8

eventtime uint64 20

exch string 14

group User Group Name string 64

init string 6

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

mode Mode string 12

msg Message string

outintf Out interface string 32

FortiOS 6.0.10 Log Reference 574

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

remip Remote IP ip 39

remport Remote Port uint16 5

result Result string 31

role Role string 9

stage uint8 3

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

version string 64

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37129 - MESGID_NEG_PROGRESS_P2_NOTIF

Message ID: 37129

Message Description: MESGID_NEG_PROGRESS_P2_NOTIF
Message Meaning: Progress IPsec phase 2
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

dir Direction string 8

FortiOS 6.0.10 Log Reference 575

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

exch string 14

group User Group Name string 64

init string 6

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

mode Mode string 12

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

result Result string 31

role Role string 9

stage uint8 3

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

version string 64

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37130 - MESGID_NEG_PROGRESS_P2_ERROR

Message ID: 37130

Message Description: MESGID_NEG_PROGRESS_P2_ERROR

FortiOS 6.0.10 Log Reference 576

Fortinet, Inc.
Log Messages

Message Meaning: Progress IPsec phase 2

Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

dir Direction string 8

eventtime uint64 20

exch string 14

group User Group Name string 64

init string 6

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

mode Mode string 12

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

result Result string 31

role Role string 9

stage uint8 3

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 577

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

version string 64

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37131 - MESGID_ESP_ERROR

Message ID: 37131

Message Description: MESGID_ESP_ERROR
Message Meaning: IPsec ESP
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

error_num Error Number string 53

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

FortiOS 6.0.10 Log Reference 578

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

remip Remote IP ip 39

remport Remote Port uint16 5

seq Sequence string 16

spi string 16

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37132 - MESGID_ESP_CRITICAL

Message ID: 37132

Message Description: MESGID_ESP_CRITICAL
Message Meaning: IPsec ESP
Type: Event
Category: VPN
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

error_num Error Number string 53

eventtime uint64 20

group User Group Name string 64

FortiOS 6.0.10 Log Reference 579

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

seq Sequence string 16

spi string 16

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37133 - MESGID_INSTALL_SA

Message ID: 37133

Message Description: MESGID_INSTALL_SA
Message Meaning: IPsec SA installed
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 580

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

in_spi string 16

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

out_spi Out SPI string 16

remip Remote IP ip 39

remport Remote Port uint16 5

role Role string 9

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37134 - MESGID_DELETE_P1_SA

Message ID: 37134

Message Description: MESGID_DELETE_P1_SA
Message Meaning: IPsec phase 1 SA deleted

FortiOS 6.0.10 Log Reference 581

Fortinet, Inc.
Log Messages

Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37135 - MESGID_DELETE_P2_SA

Message ID: 37135

Message Description: MESGID_DELETE_P2_SA

FortiOS 6.0.10 Log Reference 582

Fortinet, Inc.
Log Messages

Message Meaning: IPsec phase 2 SA deleted

Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

in_spi string 16

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

out_spi Out SPI string 16

remip Remote IP ip 39

remport Remote Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

FortiOS 6.0.10 Log Reference 583

Fortinet, Inc.
Log Messages

37136 - MESGID_DPD_FAILURE

Message ID: 37136

Message Description: MESGID_DPD_FAILURE
Message Meaning: IPsec DPD failed
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

FortiOS 6.0.10 Log Reference 584

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37137 - MESGID_CONN_FAILURE

Message ID: 37137

Message Description: MESGID_CONN_FAILURE
Message Meaning: IPsec connection failed
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

remip Remote IP ip 39

remport Remote Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 585

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37138 - MESGID_CONN_UPDOWN

Message ID: 37138

Message Description: MESGID_CONN_UPDOWN
Message Meaning: IPsec connection status changed
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

nextstat Time interval in seconds for the next statistics uint32 10

FortiOS 6.0.10 Log Reference 586

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

outintf Out interface string 32

rcvdbyte Received Bytes uint64 20

remip Remote IP ip 39

remport Remote Port uint16 5

sentbyte Bytes Sent uint64 20

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37139 - MESGID_P2_UPDOWN

Message ID: 37139

Message Description: MESGID_P2_UPDOWN
Message Meaning: IPsec phase 2 status changed
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 587

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

outintf Out interface string 32

phase2_name Phase 2 Name string 128

remip Remote IP ip 39

remport Remote Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

37141 - MESGID_CONN_STATS

Message ID: 37141

Message Description: MESGID_CONN_STATS
Message Meaning: IPsec tunnel statistics
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 588

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

assignip Assigned IP Address ip 39

cookies Cookie string 64

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

locip Local IP ip 39

locport Local Port uint16 5

logdesc Log Description string

logid Log ID string 10

msg Message string

nextstat Time interval in seconds for the next statistics uint32 10

outintf Out interface string 32

rcvdbyte Received Bytes uint64 20

remip Remote IP ip 39

remport Remote Port uint16 5

sentbyte Bytes Sent uint64 20

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vpntunnel IPsec Vpn Tunnel Name string 128

xauthgroup XAuth Group Name string 128

xauthuser XAuth User Name string 256

FortiOS 6.0.10 Log Reference 589

Fortinet, Inc.
Log Messages

37889 - MESGID_VC_DELETE

Message ID: 37889

Message Description: MESGID_VC_DELETE
Message Meaning: Virtual cluster deleted
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vcluster virtual cluster id uint32 10

vd Virtual Domain Name string 32

37890 - MESGID_VC_MOVE_VDOM

Message ID: 37890

Message Description: MESGID_VC_MOVE_VDOM
Message Meaning: Virtual cluster VDOM moved
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 590

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

from_vcluster source virtual cluster number uint32 10

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

to_vcluster destination virtual cluster number uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

vdname vdom name string 32

37891 - MESGID_VC_ADD_VDOM

Message ID: 37891

Message Description: MESGID_VC_ADD_VDOM
Message Meaning: Virtual cluster VDOM added
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 591

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to_vcluster destination virtual cluster number uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

vdname vdom name string 32

37892 - MESGID_VC_MOVE_MEMB_STATE

Message ID: 37892

Message Description: MESGID_VC_MOVE_MEMB_STATE
Message Meaning: Virtual cluster member state moved
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vcluster_member uint32 10

vcluster_state string 7

vd Virtual Domain Name string 32

37893 - MESGID_VC_DETECT_MEMB_DEAD

Message ID: 37893

Message Description: MESGID_VC_DETECT_MEMB_DEAD
Message Meaning: Virtual cluster member dead
Type: Event

FortiOS 6.0.10 Log Reference 592

Fortinet, Inc.
Log Messages

Category: HA
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ha_group HA Group Number - can be 1 - 256 uint8 3

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vcluster virtual cluster id uint32 10

vd Virtual Domain Name string 32

37894 - MESGID_VC_DETECT_MEMB_JOIN

Message ID: 37894

Message Description: MESGID_VC_DETECT_MEMB_JOIN
Message Meaning: Virtual cluster member joined
Type: Event
Category: HA
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ha_group HA Group Number - can be 1 - 256 uint8 3

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 593

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log Message string

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vcluster virtual cluster id uint32 10

vd Virtual Domain Name string 32

37895 - MESGID_VC_ADD_HADEV

Message ID: 37895

Message Description: MESGID_VC_ADD_HADEV
Message Meaning: Virtual cluster added HA device interface
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vcluster virtual cluster id uint32 10

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 594

Fortinet, Inc.
Log Messages

37896 - MESGID_VC_DEL_HADEV

Message ID: 37896

Message Description: MESGID_VC_DEL_HADEV
Message Meaning: Virtual cluster deleted HA device interface
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vcluster virtual cluster id uint32 10

vd Virtual Domain Name string 32

37897 - MESGID_HADEV_READY

Message ID: 37897

Message Description: MESGID_HADEV_READY
Message Meaning: HA device interface ready
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

FortiOS 6.0.10 Log Reference 595

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

ha_role The HA role in the cluster string 6

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37898 - MESGID_HADEV_FAIL

Message ID: 37898

Message Description: MESGID_HADEV_FAIL
Message Meaning: HA device interface failed
Type: Event
Category: HA
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

ha_role The HA role in the cluster string 6

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

FortiOS 6.0.10 Log Reference 596

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37899 - MESGID_HADEV_PEERINFO

Message ID: 37899

Message Description: MESGID_HADEV_PEERINFO
Message Meaning: HA device interface peer information
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

ha_role The HA role in the cluster string 6

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37900 - MESGID_HBDEV_DELETE

Message ID: 37900

Message Description: MESGID_HBDEV_DELETE
Message Meaning: Heartbeat device interface deleted

FortiOS 6.0.10 Log Reference 597

Fortinet, Inc.
Log Messages

Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37901 - MESGID_HBDEV_DOWN

Message ID: 37901

Message Description: MESGID_HBDEV_DOWN
Message Meaning: Heartbeat device interface down
Type: Event
Category: HA
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

ha_role The HA role in the cluster string 6

hbdn_reason heartbeat down reason string 18

FortiOS 6.0.10 Log Reference 598

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37902 - MESGID_HBDEV_UP

Message ID: 37902

Message Description: MESGID_HBDEV_UP
Message Meaning: Heartbeat device interface up
Type: Event
Category: HA
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devintfname HA device Interface Name string 32

eventtime uint64 20

ha_role The HA role in the cluster string 6

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 599

Fortinet, Inc.
Log Messages

37903 - MESGID_SYNC_STATUS

Message ID: 37903

Message Description: MESGID_SYNC_STATUS
Message Meaning: Synchronization status with master
Type: Event
Category: HA
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

sync_status The sync status with the master string 11

sync_type The sync type with the master string 14

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37904 - MESGID_HA_ACTIVITY

Message ID: 37904

Message Description: MESGID_HA_ACTIVITY
Message Meaning: Device set as HA master
Type: Event
Category: HA
Severity: Notice

Log Field Name Description Data Type Length

activity HA activity message string 128

FortiOS 6.0.10 Log Reference 600

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ha-prio HA Priority uint8 3

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37907 - MESGID_VLAN_HB_UP

Message ID: 37907

Message Description: MESGID_VLAN_HB_UP
Message Meaning: VLAN heartbeat started
Type: Event
Category: HA
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 601

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37908 - MESGID_VLAN_HB_DOWN

Message ID: 37908

Message Description: MESGID_VLAN_HB_DOWN
Message Meaning: VLAN heartbeat lost
Type: Event
Category: HA
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

37909 - MESGID_VLAN_HB_DOWN_SUM

Message ID: 37909

Message Description: MESGID_VLAN_HB_DOWN_SUM
Message Meaning: VLAN heartbeat lost summary
Type: Event
Category: HA
Severity: Error

FortiOS 6.0.10 Log Reference 602

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38010 - LOG_ID_FIPS_ENCRY_FAIL

Message ID: 38010

Message Description: LOG_ID_FIPS_ENCRY_FAIL
Message Meaning: FIPS CC encryption failed
Type: Event
Category: USER
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

FortiOS 6.0.10 Log Reference 603

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38011 - LOG_ID_FIPS_DECRY_FAIL

Message ID: 38011

Message Description: LOG_ID_FIPS_DECRY_FAIL
Message Meaning: FIPS CC decryption failed
Type: Event
Category: USER
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 604

Fortinet, Inc.
Log Messages

38012 - LOG_ID_ENTROPY_TOKEN

Message ID: 38012

Message Description: LOG_ID_ENTROPY_TOKEN
Message Meaning: Seeding from entropy source
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38031 - LOG_ID_FSSO_LOGON

Message ID: 38031

Message Description: LOG_ID_FSSO_LOGON
Message Meaning: FSSO logon successful
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 605

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

server AD server FQDN or IP string 64

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38032 - LOG_ID_FSSO_LOGOFF

Message ID: 38032

Message Description: LOG_ID_FSSO_LOGOFF
Message Meaning: FSSO logout successful
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 606

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

server AD server FQDN or IP string 64

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38033 - LOG_ID_FSSO_SVR_STATUS

Message ID: 38033

Message Description: LOG_ID_FSSO_SVR_STATUS
Message Meaning: FSSO Active Directory server authentication status
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

server AD server FQDN or IP string 64

FortiOS 6.0.10 Log Reference 607

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38400 - LOGID_EVENT_NOTIF_SEND_SUCC

Message ID: 38400

Message Description: LOGID_EVENT_NOTIF_SEND_SUCC
Message Meaning: Notification message sent
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

count Count uint32 10

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

duration Duration uint32 10

eventtime uint64 20

from Sender Email Address for Notification string 128

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

msgproto Message Protocol Number string 16

nf_type Notification Type string 14

profile Profile Name string 64

profilegroup Profile Group Name string 4

FortiOS 6.0.10 Log Reference 608

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profiletype Profile Type string 64

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

to Recipient Email Addresses for Notification string 512

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

virus Virus Name string 128

38401 - LOGID_EVENT_NOTIF_SEND_FAIL

Message ID: 38401

Message Description: LOGID_EVENT_NOTIF_SEND_FAIL
Message Meaning: Notification message send failed
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

count Count uint32 10

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

duration Duration uint32 10

eventtime uint64 20

from Sender Email Address for Notification string 128

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 609

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msgproto Message Protocol Number string 16

nf_type Notification Type string 14

profile Profile Name string 64

profilegroup Profile Group Name string 4

profiletype Profile Type string 64

service Name of Service string 64

sess_duration Session Duration uint32 10

subtype Log Subtype string 20

time Time string 8

to Recipient Email Addresses for Notification string 512

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

virus Virus Name string 128

38402 - LOGID_EVENT_NOTIF_DNS_FAIL

Message ID: 38402

Message Description: LOGID_EVENT_NOTIF_DNS_FAIL
Message Meaning: MMSC hostname unresolvable
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

hostname Hostname string 128

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 610

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

profile Profile Name string 64

profiletype Profile Type string 64

profile_vd Virtual Domain Name string 64

service Name of Service string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38403 - LOGID_EVENT_NOTIF_INSUFFICIENT_RESOURCE

Message ID: 38403

Message Description: LOGID_EVENT_NOTIF_INSUFFICIENT_RESOURCE
Message Meaning: Insufficient system resource notification
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 611

Fortinet, Inc.
Log Messages

38404 - LOGID_EVENT_NOTIF_HOSTNAME_ERROR

Message ID: 38404

Message Description: LOGID_EVENT_NOTIF_HOSTNAME_ERROR
Message Meaning: FortiGuard hostname unresolvable
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

hostname Hostname string 128

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38405 - LOGID_NOTIF_CODE_SENDTO_SMS_PHONE

Message ID: 38405

Message Description: LOGID_NOTIF_CODE_SENDTO_SMS_PHONE
Message Meaning: Guest user account login information sent to phone
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 612

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38406 - LOGID_NOTIF_CODE_SENDTO_SMS_TO

Message ID: 38406

Message Description: LOGID_NOTIF_CODE_SENDTO_SMS_TO
Message Meaning: Guest user account login information sent as SMS
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 613

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38407 - LOGID_NOTIF_CODE_SENDTO_EMAIL

Message ID: 38407

Message Description: LOGID_NOTIF_CODE_SENDTO_EMAIL
Message Meaning: Guest user account login information sent to email
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38408 - LOGID_EVENT_OFTP_SSL_CONNECTED

Message ID: 38408

Message Description: LOGID_EVENT_OFTP_SSL_CONNECTED
Message Meaning: SSL connection established
Type: Event

FortiOS 6.0.10 Log Reference 614

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38409 - LOGID_EVENT_OFTP_SSL_DISCONNECTED

Message ID: 38409

Message Description: LOGID_EVENT_OFTP_SSL_DISCONNECTED
Message Meaning: SSL connection closed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 615

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38410 - LOGID_EVENT_OFTP_SSL_FAILED

Message ID: 38410

Message Description: LOGID_EVENT_OFTP_SSL_FAILED
Message Meaning: SSL connection failed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

reason Reason string 256

FortiOS 6.0.10 Log Reference 616

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38411 - LOGID_EVENT_TWO_F_AUTH_CODE_SENDTO

Message ID: 38411

Message Description: LOGID_EVENT_TWO_F_AUTH_CODE_SENDTO
Message Meaning: Two-factor authentication code sent
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38412 - LOGID_EVENT_TOKEN_CODE_SENDTO

Message ID: 38412

Message Description: LOGID_EVENT_TOKEN_CODE_SENDTO

FortiOS 6.0.10 Log Reference 617

Fortinet, Inc.
Log Messages

Message Meaning: Token activation code sent

Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

38420 - LOGID_EVENT_HTTPS_CONNECTION

Message ID: 38420

Message Description: LOGID_EVENT_HTTPS_CONNECTION
Message Meaning: HTTPS connection
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 618

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

reason Reason string 256

remote Remote IP Address ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38656 - LOGID_EVENT_RAD_RPT_PROTO_ERROR

Message ID: 38656

Message Description: LOGID_EVENT_RAD_RPT_PROTO_ERROR
Message Meaning: RADIUS protocol error summary
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 619

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

38657 - LOGID_EVENT_RAD_RPT_PROF_NOT_FOUND

Message ID: 38657

Message Description: LOGID_EVENT_RAD_RPT_PROF_NOT_FOUND
Message Meaning: RADIUS profile not found summary
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38658 - LOGID_EVENT_RAD_RPT_CTX_NOT_FOUND

Message ID: 38658

Message Description: LOGID_EVENT_RAD_RPT_CTX_NOT_FOUND
Message Meaning: RADIUS profile CTX not found summary
Type: Event
Category: USER

FortiOS 6.0.10 Log Reference 620

Fortinet, Inc.
Log Messages

Severity: Notice

Log Field Name Description Data Type Length

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38659 - LOGID_EVENT_RAD_RPT_ACCT_STOP_MISSED

Message ID: 38659

Message Description: LOGID_EVENT_RAD_RPT_ACCT_STOP_MISSED
Message Meaning: RADIUS accounting stop message missing summary
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 621

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38660 - LOGID_EVENT_RAD_RPT_ACCT_EVENT

Message ID: 38660

Message Description: LOGID_EVENT_RAD_RPT_ACCT_EVENT
Message Meaning: RADIUS accounting event summary
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38661 - LOGID_EVENT_RAD_RPT_OTHER

Message ID: 38661

FortiOS 6.0.10 Log Reference 622

Fortinet, Inc.
Log Messages

Message Description: LOGID_EVENT_RAD_RPT_OTHER

Message Meaning: RADIUS endpoint block event or other event summary
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38662 - LOGID_EVENT_RAD_STAT_PROTO_ERROR

Message ID: 38662

Message Description: LOGID_EVENT_RAD_STAT_PROTO_ERROR
Message Meaning: RADIUS accounting protocol error
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

acct_stat Accounting state (RADIUS) string 14

carrier_ep The FortiOS Carrier end-point identification string 64

date Date string 10

FortiOS 6.0.10 Log Reference 623

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

rsso_key RADIUS SSO attribute value string 64

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38663 - LOGID_EVENT_RAD_STAT_PROF_NOT_FOUND

Message ID: 38663

Message Description: LOGID_EVENT_RAD_STAT_PROF_NOT_FOUND
Message Meaning: RADIUS accounting profile not found
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

acct_stat Accounting state (RADIUS) string 14

carrier_ep The FortiOS Carrier end-point identification string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 624

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message string

reason Reason string 256

rsso_key RADIUS SSO attribute value string 64

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38665 - LOGID_EVENT_RAD_STAT_ACCT_STOP_MISSED

Message ID: 38665

Message Description: LOGID_EVENT_RAD_STAT_ACCT_STOP_MISSED
Message Meaning: RADIUS accounting stop message missing
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

acct_stat Accounting state (RADIUS) string 14

carrier_ep The FortiOS Carrier end-point identification string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

rsso_key RADIUS SSO attribute value string 64

srcip Source IP ip 39

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 625

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38666 - LOGID_EVENT_RAD_STAT_ACCT_EVENT

Message ID: 38666

Message Description: LOGID_EVENT_RAD_STAT_ACCT_EVENT
Message Meaning: RADIUS accounting event
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

acct_stat Accounting state (RADIUS) string 14

carrier_ep The FortiOS Carrier end-point identification string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

rsso_key RADIUS SSO attribute value string 64

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38667 - LOGID_EVENT_RAD_STAT_OTHER

Message ID: 38667

Message Description: LOGID_EVENT_RAD_STAT_OTHER

FortiOS 6.0.10 Log Reference 626

Fortinet, Inc.
Log Messages

Message Meaning: RADIUS other accounting event

Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

acct_stat Accounting state (RADIUS) string 14

carrier_ep The FortiOS Carrier end-point identification string 64

count Number of Packets uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

rsso_key RADIUS SSO attribute value string 64

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

38668 - LOGID_EVENT_RAD_STAT_EP_BLK

Message ID: 38668

Message Description: LOGID_EVENT_RAD_STAT_EP_BLK
Message Meaning: RADIUS endpoint block event
Type: Event
Category: USER
Severity: Notice

FortiOS 6.0.10 Log Reference 627

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

acct_stat Accounting state (RADIUS) string 14

carrier_ep The FortiOS Carrier end-point identification string 64

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

rsso_key RADIUS SSO attribute value string 64

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

39424 - LOG_ID_EVENT_SSL_VPN_USER_TUNNEL_UP

Message ID: 39424

Message Description: LOG_ID_EVENT_SSL_VPN_USER_TUNNEL_UP
Message Meaning: SSL VPN tunnel up
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

FortiOS 6.0.10 Log Reference 628

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39425 - LOG_ID_EVENT_SSL_VPN_USER_TUNNEL_DOWN

Message ID: 39425

Message Description: LOG_ID_EVENT_SSL_VPN_USER_TUNNEL_DOWN
Message Meaning: SSL VPN tunnel down
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

duration Duration uint32 10

eventtime uint64 20

group User Group Name string 64

FortiOS 6.0.10 Log Reference 629

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

rcvdbyte Received Bytes uint64 20

reason Reason string 256

remip Remote IP ip 39

sentbyte Bytes Sent uint64 20

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39426 - LOG_ID_EVENT_SSL_VPN_USER_SSL_LOGIN_FAIL

Message ID: 39426

Message Description: LOG_ID_EVENT_SSL_VPN_USER_SSL_LOGIN_FAIL
Message Meaning: SSL VPN login fail
Type: Event
Category: VPN
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

FortiOS 6.0.10 Log Reference 630

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39936 - LOG_ID_EVENT_SSL_VPN_SESSION_WEB_TUNNEL_STATS

Message ID: 39936

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_WEB_TUNNEL_STATS
Message Meaning: SSL VPN statistics
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

duration Duration uint32 10

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 631

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message string

nextstat Time interval in seconds for the next statistics uint32 10

rcvdbyte Received Bytes uint64 20

remip Remote IP ip 39

sentbyte Bytes Sent uint64 20

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39937 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_DENY

Message ID: 39937

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_DENY
Message Meaning: SSL VPN deny
Type: Event
Category: VPN
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 632

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39938 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_PASS

Message ID: 39938

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_PASS
Message Meaning: SSL VPN pass
Type: Event
Category: VPN
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 633

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39939 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_TIMEOUT

Message ID: 39939

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_TIMEOUT
Message Meaning: SSL VPN timeout
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

FortiOS 6.0.10 Log Reference 634

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39940 - LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_CLOSE

Message ID: 39940

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_WEBAPP_CLOSE
Message Meaning: SSL VPN close
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 635

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39941 - LOG_ID_EVENT_SSL_VPN_SESSION_SYS_BUSY

Message ID: 39941

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_SYS_BUSY
Message Meaning: SSL VPN system busy
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

FortiOS 6.0.10 Log Reference 636

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39942 - LOG_ID_EVENT_SSL_VPN_SESSION_CERT_OK

Message ID: 39942

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_CERT_OK
Message Meaning: SSL VPN certificate OK
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

FortiOS 6.0.10 Log Reference 637

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

39943 - LOG_ID_EVENT_SSL_VPN_SESSION_NEW_CON

Message ID: 39943

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_NEW_CON
Message Meaning: SSL VPN new connection
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 638

Fortinet, Inc.
Log Messages

39944 - LOG_ID_EVENT_SSL_VPN_SESSION_ALERT

Message ID: 39944

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_ALERT
Message Meaning: SSL VPN alert
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

desc string 128

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39945 - LOG_ID_EVENT_SSL_VPN_SESSION_EXIT_FAIL

Message ID: 39945

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_EXIT_FAIL

FortiOS 6.0.10 Log Reference 639

Fortinet, Inc.
Log Messages

Message Meaning: SSL VPN exit fail

Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39946 - LOG_ID_EVENT_SSL_VPN_SESSION_EXIT_ERR

Message ID: 39946

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_EXIT_ERR
Message Meaning: SSL VPN exit error
Type: Event
Category: VPN
Severity: Error

FortiOS 6.0.10 Log Reference 640

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39947 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_UP

Message ID: 39947

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_UP
Message Meaning: SSL VPN tunnel up
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 641

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39948 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_DOWN

Message ID: 39948

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_DOWN
Message Meaning: SSL VPN tunnel down
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

FortiOS 6.0.10 Log Reference 642

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

duration Duration uint32 10

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

rcvdbyte Received Bytes uint64 20

reason Reason string 256

remip Remote IP ip 39

sentbyte Bytes Sent uint64 20

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39949 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_STATS

Message ID: 39949

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_STATS
Message Meaning: SSL VPN statistics
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 643

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dst_host string 64

duration Duration uint32 10

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

nextstat Time interval in seconds for the next statistics uint32 10

rcvdbyte Received Bytes uint64 20

remip Remote IP ip 39

sentbyte Bytes Sent uint64 20

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39950 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_UNKNOWNTAG

Message ID: 39950

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_UNKNOWNTAG
Message Meaning: SSL VPN unknown tag
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 644

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39951 - LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_ERROR

Message ID: 39951

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_TUNNEL_ERROR
Message Meaning: SSL VPN tunnel error
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

FortiOS 6.0.10 Log Reference 645

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39952 - LOG_ID_EVENT_SSL_VPN_SESSION_ENTER_CONSERVE_MODE

Message ID: 39952

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_ENTER_CONSERVE_MODE
Message Meaning: SSL VPN enter conserve mode
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

FortiOS 6.0.10 Log Reference 646

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

39953 - LOG_ID_EVENT_SSL_VPN_SESSION_LEAVE_CONSERVE_MODE

Message ID: 39953

Message Description: LOG_ID_EVENT_SSL_VPN_SESSION_LEAVE_CONSERVE_MODE
Message Meaning: SSL VPN leave conserve mode
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dst_host string 64

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 647

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

reason Reason string 256

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40001 - LOG_ID_PPTP_TUNNEL_UP

Message ID: 40001

Message Description: LOG_ID_PPTP_TUNNEL_UP
Message Meaning: PPTP tunnel up
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

FortiOS 6.0.10 Log Reference 648

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40002 - LOG_ID_PPTP_TUNNEL_DOWN

Message ID: 40002

Message Description: LOG_ID_PPTP_TUNNEL_DOWN
Message Meaning: PPTP tunnel down
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

FortiOS 6.0.10 Log Reference 649

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40003 - LOG_ID_PPTP_TUNNEL_STAT

Message ID: 40003

Message Description: LOG_ID_PPTP_TUNNEL_STAT
Message Meaning: PPTP tunnel status
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

FortiOS 6.0.10 Log Reference 650

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

40014 - LOG_ID_PPTP_REACH_MAX_CON

Message ID: 40014

Message Description: LOG_ID_PPTP_REACH_MAX_CON
Message Meaning: PPTP client connection limit reached
Type: Event
Category: VPN
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40017 - LOG_ID_L2TPD_CLIENT_CON_FAIL

Message ID: 40017

Message Description: LOG_ID_L2TPD_CLIENT_CON_FAIL
Message Meaning: L2TP client connection failed
Type: Event
Category: VPN

FortiOS 6.0.10 Log Reference 651

Fortinet, Inc.
Log Messages

Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40019 - LOG_ID_L2TPD_CLIENT_DISCON

Message ID: 40019

Message Description: LOG_ID_L2TPD_CLIENT_DISCON
Message Meaning: L2TP client disconnected
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 652

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40021 - LOG_ID_PPTP_NOT_CONIG

Message ID: 40021

Message Description: LOG_ID_PPTP_NOT_CONIG
Message Meaning: PPTP not configured in VDOM
Type: Event
Category: VPN
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 653

Fortinet, Inc.
Log Messages

40022 - LOG_ID_PPTP_NO_IP_AVAIL

Message ID: 40022

Message Description: LOG_ID_PPTP_NO_IP_AVAIL
Message Meaning: PPTP IP addresses unavailable
Type: Event
Category: VPN
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40024 - LOG_ID_PPTP_OUT_MEM

Message ID: 40024

Message Description: LOG_ID_PPTP_OUT_MEM
Message Meaning: PPTP config list insufficient memory
Type: Event
Category: VPN
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 654

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40034 - LOG_ID_PPTP_START

Message ID: 40034

Message Description: LOG_ID_PPTP_START
Message Meaning: PPTP daemon started
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

FortiOS 6.0.10 Log Reference 655

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40035 - LOG_ID_PPTP_START_FAIL

Message ID: 40035

Message Description: LOG_ID_PPTP_START_FAIL
Message Meaning: PPTP daemon failed to start
Type: Event
Category: VPN
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40036 - LOG_ID_PPTP_EXIT

Message ID: 40036

Message Description: LOG_ID_PPTP_EXIT

FortiOS 6.0.10 Log Reference 656

Fortinet, Inc.
Log Messages

Message Meaning: PPTP daemon exited

Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40037 - LOG_ID_PPTPD_SVR_DISCON

Message ID: 40037

Message Description: LOG_ID_PPTPD_SVR_DISCON
Message Meaning: PPTP daemon disconnected
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 657

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40038 - LOG_ID_PPTPD_CLIENT_CON

Message ID: 40038

Message Description: LOG_ID_PPTPD_CLIENT_CON
Message Meaning: PPTP client connected
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 658

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

40039 - LOG_ID_PPTPD_CLIENT_DISCON

Message ID: 40039

Message Description: LOG_ID_PPTPD_CLIENT_DISCON
Message Meaning: PPTP client disconnected
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40101 - LOG_ID_L2TP_TUNNEL_UP

Message ID: 40101

Message Description: LOG_ID_L2TP_TUNNEL_UP
Message Meaning: L2TP tunnel up
Type: Event
Category: VPN

FortiOS 6.0.10 Log Reference 659

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40102 - LOG_ID_L2TP_TUNNEL_DOWN

Message ID: 40102

Message Description: LOG_ID_L2TP_TUNNEL_DOWN
Message Meaning: L2TP tunnel down
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 660

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40103 - LOG_ID_L2TP_TUNNEL_STAT

Message ID: 40103

Message Description: LOG_ID_L2TP_TUNNEL_STAT
Message Meaning: L2TP tunnel status
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

group User Group Name string 64

FortiOS 6.0.10 Log Reference 661

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

remip Remote IP ip 39

subtype Log Subtype string 20

time Time string 8

tunnelid Tunnel ID uint32 10

tunnelip Tunnel IP ip 39

tunneltype Tunnel Type string 64

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40114 - LOG_ID_L2TPD_START

Message ID: 40114

Message Description: LOG_ID_L2TPD_START
Message Meaning: L2TP daemon started
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

FortiOS 6.0.10 Log Reference 662

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40115 - LOG_ID_L2TPD_EXIT

Message ID: 40115

Message Description: LOG_ID_L2TPD_EXIT
Message Meaning: L2TP daemon exited
Type: Event
Category: VPN
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40118 - LOG_ID_L2TPD_CLIENT_CON

Message ID: 40118

Message Description: LOG_ID_L2TPD_CLIENT_CON

FortiOS 6.0.10 Log Reference 663

Fortinet, Inc.
Log Messages

Message Meaning: L2TP client connected

Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40704 - LOG_ID_EVENT_SYS_PERF

Message ID: 40704

Message Description: LOG_ID_EVENT_SYS_PERF
Message Meaning: System performance statistics
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

bandwidth Bandwidth string 42

cpu CPU Usage uint8 3

date Date string 10

FortiOS 6.0.10 Log Reference 664

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

disk Disk Usage uint8 3

disklograte Disk Log Rate uint64 20

eventtime uint64 20

fazlograte FortiAnalyzer Logging Rate uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mem Memory Usage uint8 3

msg Message Text string

setuprate Session Setup Rate uint64 20

subtype Log Subtype string 20

time Time string 8

totalsession Total Number of Sessions uint32 10

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

40705 - LOG_ID_EVENT_SYS_CPU_USAGE

Message ID: 40705

Message Description: LOG_ID_EVENT_SYS_CPU_USAGE
Message Meaning: CPU usage statistics
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

cpu CPU Usage uint8 3

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 665

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

40960 - LOGID_EVENT_WAD_WEBPROXY_FWD_SRV_ERROR

Message ID: 40960

Message Description: LOGID_EVENT_WAD_WEBPROXY_FWD_SRV_ERROR
Message Meaning: Web proxy forward server error
Type: Event
Category: WAD
Severity: Notice

Log Field Name Description Data Type Length

addr_type Address Type string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

fqdn Fully Qualified Domain Name string 256

fwserver_name string 32

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

port Port Number uint16 5

FortiOS 6.0.10 Log Reference 666

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41000 - LOG_ID_UPD_FGT_SUCC

Message ID: 41000

Message Description: LOG_ID_UPD_FGT_SUCC
Message Meaning: FortiGate update succeeded
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41001 - LOG_ID_UPD_FGT_FAIL

Message ID: 41001

Message Description: LOG_ID_UPD_FGT_FAIL
Message Meaning: FortiGate update failed
Type: Event

FortiOS 6.0.10 Log Reference 667

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41002 - LOG_ID_UPD_SRC_VIS

Message ID: 41002

Message Description: LOG_ID_UPD_SRC_VIS
Message Meaning: Source visibility signature package updated
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

status Status string 23

FortiOS 6.0.10 Log Reference 668

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41006 - LOG_ID_UPD_FSA_VIRDB

Message ID: 41006

Message Description: LOG_ID_UPD_FSA_VIRDB
Message Meaning: FortiSandbox AV database updated
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

version Version string 64

41984 - LOG_ID_EVENT_VPN_CERT_LOAD

Message ID: 41984

Message Description: LOG_ID_EVENT_VPN_CERT_LOAD
Message Meaning: Certificate loaded
Type: Event

FortiOS 6.0.10 Log Reference 669

Fortinet, Inc.
Log Messages

Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

41985 - LOG_ID_EVENT_VPN_CERT_REMOVAL

Message ID: 41985

Message Description: LOG_ID_EVENT_VPN_CERT_REMOVAL
Message Meaning: Certificate removed
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

FortiOS 6.0.10 Log Reference 670

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

41986 - LOG_ID_EVENT_VPN_CERT_REGEN

Message ID: 41986

Message Description: LOG_ID_EVENT_VPN_CERT_REGEN
Message Meaning: Certificate regenerated
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 671

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

41987 - LOG_ID_EVENT_VPN_CERT_UPDATE

Message ID: 41987

Message Description: LOG_ID_EVENT_VPN_CERT_UPDATE
Message Meaning: Certificate updated
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method Method string 64

msg Message string

name Name string 128

FortiOS 6.0.10 Log Reference 672

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41988 - LOG_ID_EVENT_SSL_VPN_SETTING_UPDATE

Message ID: 41988

Message Description: LOG_ID_EVENT_SSL_VPN_SETTING_UPDATE
Message Meaning: SSL setting changed
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 673

Fortinet, Inc.
Log Messages

41989 - LOG_ID_EVENT_VPN_CERT_ERR

Message ID: 41989

Message Description: LOG_ID_EVENT_VPN_CERT_ERR
Message Meaning: Certificate error
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method Method string 64

msg Message string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41990 - LOG_ID_EVENT_VPN_CERT_UPDATE_FAILED

Message ID: 41990

Message Description: LOG_ID_EVENT_VPN_CERT_UPDATE_FAILED
Message Meaning: Certificate update failed
Type: Event
Category: VPN
Severity: Information

FortiOS 6.0.10 Log Reference 674

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

method Method string 64

msg Message string

name Name string 128

reason Reason string 256

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

41991 - LOG_ID_EVENT_VPN_CERT_EXPORT

Message ID: 41991

Message Description: LOG_ID_EVENT_VPN_CERT_EXPORT
Message Meaning: Certificate exported
Type: Event
Category: VPN
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cert-type Certification type string 6

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 675

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

name Name string 128

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

42201 - LOG_ID_NETX_VMX_ATTACH

Message ID: 42201

Message Description: LOG_ID_NETX_VMX_ATTACH
Message Meaning: VMX instance successfully attached
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 676

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

42202 - LOG_ID_NETX_VMX_DETACH

Message ID: 42202

Message Description: LOG_ID_NETX_VMX_DETACH
Message Meaning: VMX instance successfully detached
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

42203 - LOG_ID_NETX_VMX_DENIED

Message ID: 42203

Message Description: LOG_ID_NETX_VMX_DENIED
Message Meaning: VMX instance successfully denied
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 677

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43008 - LOG_ID_EVENT_AUTH_SUCCESS

Message ID: 43008

Message Description: LOG_ID_EVENT_AUTH_SUCCESS
Message Meaning: Authentication success
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 678

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43009 - LOG_ID_EVENT_AUTH_FAILED

Message ID: 43009

Message Description: LOG_ID_EVENT_AUTH_FAILED
Message Meaning: Authentication failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 679

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43010 - LOG_ID_EVENT_AUTH_LOCKOUT

Message ID: 43010

Message Description: LOG_ID_EVENT_AUTH_LOCKOUT
Message Meaning: Authentication lockout
Type: Event
Category: USER
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 680

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43011 - LOG_ID_EVENT_AUTH_TIME_OUT

Message ID: 43011

Message Description: LOG_ID_EVENT_AUTH_TIME_OUT
Message Meaning: Authentication timed out
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

authserver string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

FortiOS 6.0.10 Log Reference 681

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43014 - LOG_ID_EVENT_AUTH_FSAE_LOGON

Message ID: 43014

Message Description: LOG_ID_EVENT_AUTH_FSAE_LOGON
Message Meaning: FSSO logon authentication status
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

server AD server FQDN or IP string 64

FortiOS 6.0.10 Log Reference 682

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43015 - LOG_ID_EVENT_AUTH_FSAE_LOGOFF

Message ID: 43015

Message Description: LOG_ID_EVENT_AUTH_FSAE_LOGOFF
Message Meaning: FSSO log off authentication status
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

server AD server FQDN or IP string 64

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 683

Fortinet, Inc.
Log Messages

43016 - LOG_ID_EVENT_AUTH_NTLM_AUTH_SUCCESS

Message ID: 43016

Message Description: LOG_ID_EVENT_AUTH_NTLM_AUTH_SUCCESS
Message Meaning: NTLM authentication successful
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

adgroup AD Group Name string 128

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43017 - LOG_ID_EVENT_AUTH_NTLM_AUTH_FAIL

Message ID: 43017

FortiOS 6.0.10 Log Reference 684

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_EVENT_AUTH_NTLM_AUTH_FAIL

Message Meaning: NTLM authentication failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

adgroup AD Group Name string 128

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43018 - LOG_ID_EVENT_AUTH_FGOVRD_FAIL

Message ID: 43018

Message Description: LOG_ID_EVENT_AUTH_FGOVRD_FAIL
Message Meaning: FortiGuard override failed
Type: Event

FortiOS 6.0.10 Log Reference 685

Fortinet, Inc.
Log Messages

Category: USER
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

initiator Original login user name for Fortiguard override string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43020 - LOG_ID_EVENT_AUTH_FGOVRD_SUCCESS

Message ID: 43020

Message Description: LOG_ID_EVENT_AUTH_FGOVRD_SUCCESS
Message Meaning: FortiGuard override successful
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

FortiOS 6.0.10 Log Reference 686

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

expiry FortiGuard override expiry timestamp string 64

initiator Original login user name for Fortiguard override string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

oldwprof Old Web Filter Profile string 64

reason Reason string 256

scope FortiGuard Override Scope string 16

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43025 - LOG_ID_EVENT_AUTH_PROXY_SUCCESS

Message ID: 43025

Message Description: LOG_ID_EVENT_AUTH_PROXY_SUCCESS
Message Meaning: Explicit proxy authentication successful
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

FortiOS 6.0.10 Log Reference 687

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43026 - LOG_ID_EVENT_AUTH_PROXY_FAILED

Message ID: 43026

Message Description: LOG_ID_EVENT_AUTH_PROXY_FAILED
Message Meaning: Explicit proxy authentication failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

FortiOS 6.0.10 Log Reference 688

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43027 - LOG_ID_EVENT_AUTH_PROXY_TIME_OUT

Message ID: 43027

Message Description: LOG_ID_EVENT_AUTH_PROXY_TIME_OUT
Message Meaning: Explicit proxy authentication timed out
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 689

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43028 - LOG_ID_EVENT_AUTH_PROXY_GROUP_INFO_FAILED

Message ID: 43028

Message Description: LOG_ID_EVENT_AUTH_PROXY_GROUP_INFO_FAILED
Message Meaning: Explicit proxy user group query failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 690

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43029 - LOG_ID_EVENT_AUTH_WARNING_SUCCESS

Message ID: 43029

Message Description: LOG_ID_EVENT_AUTH_WARNING_SUCCESS
Message Meaning: FortiGuard authentication override successful
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

category uint32 10

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

expiry FortiGuard override expiry timestamp string 64

initiator Original login user name for Fortiguard override string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 691

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message string

oldwprof Old Web Filter Profile string 64

reason Reason string 256

scope FortiGuard Override Scope string 16

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43030 - LOG_ID_EVENT_AUTH_WARNING_TBL_FULL

Message ID: 43030

Message Description: LOG_ID_EVENT_AUTH_WARNING_TBL_FULL
Message Meaning: FortiGuard authentication override failed
Type: Event
Category: USER
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

initiator Original login user name for Fortiguard override string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

srcip Source IP ip 39

FortiOS 6.0.10 Log Reference 692

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43032 - LOG_ID_EVENT_AUTH_PROXY_USER_LIMIT_REACHED

Message ID: 43032

Message Description: LOG_ID_EVENT_AUTH_PROXY_USER_LIMIT_REACHED
Message Meaning: Explicit proxy authentication user limit reached
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 693

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43033 - LOG_ID_EVENT_AUTH_PROXY_MULTIPLE_LOGIN

Message ID: 43033

Message Description: LOG_ID_EVENT_AUTH_PROXY_MULTIPLE_LOGIN
Message Meaning: Explicit proxy authentication user concurrent check failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 694

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43034 - LOG_ID_EVENT_AUTH_PROXY_NO_RESP

Message ID: 43034

Message Description: LOG_ID_EVENT_AUTH_PROXY_NO_RESP
Message Meaning: Explicit proxy authentication no response
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

agent string 64

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

url string 512

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 695

Fortinet, Inc.
Log Messages

43037 - LOG_ID_EVENT_AUTH_IPV4_FLUSH

Message ID: 43037

Message Description: LOG_ID_EVENT_AUTH_IPV4_FLUSH
Message Meaning: Authentication IPv4 logon flush
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43038 - LOG_ID_EVENT_AUTH_IPV6_FLUSH

Message ID: 43038

Message Description: LOG_ID_EVENT_AUTH_IPV6_FLUSH
Message Meaning: Authentication IPv6 logon flush
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 696

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43039 - LOG_ID_EVENT_AUTH_LOGON

Message ID: 43039

Message Description: LOG_ID_EVENT_AUTH_LOGON
Message Meaning: Authentication logon
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authserver string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

FortiOS 6.0.10 Log Reference 697

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43040 - LOG_ID_EVENT_AUTH_LOGOUT

Message ID: 43040

Message Description: LOG_ID_EVENT_AUTH_LOGOUT
Message Meaning: Authentication logout
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authserver string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 698

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

43041 - LOG_ID_EVENT_AUTH_DISCLAIMER_ACCEPT

Message ID: 43041

Message Description: LOG_ID_EVENT_AUTH_DISCLAIMER_ACCEPT
Message Meaning: Disclaimer accepted
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 699

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

43042 - LOG_ID_EVENT_AUTH_DISCLAIMER_DECLINE

Message ID: 43042

Message Description: LOG_ID_EVENT_AUTH_DISCLAIMER_DECLINE
Message Meaning: Disclaimer declined
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 700

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

43043 - LOG_ID_EVENT_AUTH_EMAIL_COLLECTING_SUCCESS

Message ID: 43043

Message Description: LOG_ID_EVENT_AUTH_EMAIL_COLLECTING_SUCCESS
Message Meaning: Email collecting succeeded
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 701

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

43044 - LOG_ID_EVENT_AUTH_EMAIL_COLLECTING_FAIL

Message ID: 43044

Message Description: LOG_ID_EVENT_AUTH_EMAIL_COLLECTING_FAIL
Message Meaning: Email collecting failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

authproto The protocol that initiated the authentication string 512

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

eventtime uint64 20

group User Group Name string 64

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

policyid Policy ID uint32 10

reason Reason string 256

srcip Source IP ip 39

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 702

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

43045 - LOG_ID_EVENT_AUTH_8021X_SUCCESS

Message ID: 43045

Message Description: LOG_ID_EVENT_AUTH_8021X_SUCCESS
Message Meaning: 802.1x authentication succeeded
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

stamac string 17

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43046 - LOG_ID_EVENT_AUTH_8021X_FAIL

Message ID: 43046

FortiOS 6.0.10 Log Reference 703

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_EVENT_AUTH_8021X_FAIL

Message Meaning: 802.1x authentication failed
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

interface string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

reason Reason string 256

stamac string 17

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43050 - LOG_ID_EVENT_AUTH_FSAE_CONNECT

Message ID: 43050

Message Description: LOG_ID_EVENT_AUTH_FSAE_CONNECT
Message Meaning: FSSO server connected
Type: Event
Category: USER
Severity: Notice

FortiOS 6.0.10 Log Reference 704

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

server AD server FQDN or IP string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43051 - LOG_ID_EVENT_AUTH_FSAE_DISCONNECT

Message ID: 43051

Message Description: LOG_ID_EVENT_AUTH_FSAE_DISCONNECT
Message Meaning: FSSO server disconnected
Type: Event
Category: USER
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message string

FortiOS 6.0.10 Log Reference 705

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

server AD server FQDN or IP string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43264 - LOGID_MMS_STATS

Message ID: 43264

Message Description: LOGID_MMS_STATS
Message Meaning: MMS statistics
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

checksum for MMS Statistics uint32 10

date Date string 10

devid Device ID string 16

duration Duration uint32 10

eventtime uint64 20

infected Infected MMS uint32 10

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msgproto Message Protocol Number string 16

scanned Number of Scanned MMSs uint32 10

subtype Log Subtype string 20

suspicious Number of Suspicious MMSs uint32 10

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 706

Fortinet, Inc.
Log Messages

43520 - LOG_ID_EVENT_WIRELESS_SYS

Message ID: 43520

Message Description: LOG_ID_EVENT_WIRELESS_SYS
Message Meaning: Wireless system activity
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43521 - LOG_ID_EVENT_WIRELESS_ROGUE

Message ID: 43521

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE
Message Meaning: Rogue AP activity
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

FortiOS 6.0.10 Log Reference 707

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 708

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43522 - LOG_ID_EVENT_WIRELESS_WTP

Message ID: 43522

Message Description: LOG_ID_EVENT_WIRELESS_WTP
Message Meaning: Physical AP activity
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 709

Fortinet, Inc.
Log Messages

43524 - LOG_ID_EVENT_WIRELESS_STA

Message ID: 43524

Message Description: LOG_ID_EVENT_WIRELESS_STA
Message Meaning: Wireless client activity
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 710

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43525 - LOG_ID_EVENT_WIRELESS_ONWIRE

Message ID: 43525

Message Description: LOG_ID_EVENT_WIRELESS_ONWIRE
Message Meaning: Rogue AP on wire
Type: Event
Category: WIRELESS
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

FortiOS 6.0.10 Log Reference 711

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43526 - LOG_ID_EVENT_WIRELESS_WTPR

Message ID: 43526

Message Description: LOG_ID_EVENT_WIRELESS_WTPR
Message Meaning: Physical AP radio activity
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

FortiOS 6.0.10 Log Reference 712

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43527 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG

Message ID: 43527

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_CFG
Message Meaning: Rogue AP status configured
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

apstatus Access Point Status uint8 3

FortiOS 6.0.10 Log Reference 713

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

bssid Service Set ID string 17

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

ssid Base Service Set ID string 33

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43528 - LOG_ID_EVENT_WIRELESS_WTPR_ERROR

Message ID: 43528

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_ERROR
Message Meaning: Physical AP radio error activity
Type: Event
Category: WIRELESS
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 714

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43529 - LOG_ID_EVENT_WIRELESS_CLB

Message ID: 43529

Message Description: LOG_ID_EVENT_WIRELESS_CLB
Message Meaning: Wireless client load balancing
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 715

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log Message string

radioband Radio Band string 64

reason Reason string 256

sn Serial Number string 64

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vap string 36

vd Virtual Domain Name string 32

43530 - LOG_ID_EVENT_WIRELESS_WIDS_WL_BRIDGE

Message ID: 43530

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_WL_BRIDGE
Message Meaning: Wireless bridge intrusion detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

FortiOS 6.0.10 Log Reference 716

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43531 - LOG_ID_EVENT_WIRELESS_WIDS_BR_DEAUTH

Message ID: 43531

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_BR_DEAUTH
Message Meaning: Wireless broadcasting deauthentication detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

FortiOS 6.0.10 Log Reference 717

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43532 - LOG_ID_EVENT_WIRELESS_WIDS_NL_PBRESP

Message ID: 43532

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_NL_PBRESP
Message Meaning: Wireless null SSID probe response detected
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 718

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43533 - LOG_ID_EVENT_WIRELESS_WIDS_MAC_OUI

Message ID: 43533

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_MAC_OUI
Message Meaning: Wireless invalid MAC OUI detected

FortiOS 6.0.10 Log Reference 719

Fortinet, Inc.
Log Messages

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

eventtime uint64 20

frametype Frame Type string 32

invalidmac the MAC address with invalid OUI string 17

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 720

Fortinet, Inc.
Log Messages

43534 - LOG_ID_EVENT_WIRELESS_WIDS_LONG_DUR

Message ID: 43534

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_LONG_DUR
Message Meaning: Wireless long duration attack detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

duration Duration of the last threatening packed captured from TA uint32 10

encrypt whether the packet is encrypted or not uint8 3

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

FortiOS 6.0.10 Log Reference 721

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43535 - LOG_ID_EVENT_WIRELESS_WIDS_WEP_IV

Message ID: 43535

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_WEP_IV
Message Meaning: Wireless Weak WEP IV detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

FortiOS 6.0.10 Log Reference 722

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

weakwepiv Weak Wep Initiation Vector string 8

43542 - LOG_ID_EVENT_WIRELESS_WIDS_EAPOL_FLOOD

Message ID: 43542

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_EAPOL_FLOOD
Message Meaning: Wireless EAPOL packet flooding detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eapolcnt EAPOL packet count uint32 10

eapoltype EAPOL packet type string 16

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

FortiOS 6.0.10 Log Reference 723

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43544 - LOG_ID_EVENT_WIRELESS_WIDS_MGMT_FLOOD

Message ID: 43544

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_MGMT_FLOOD
Message Meaning: Wireless management flooding detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

FortiOS 6.0.10 Log Reference 724

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

manuf Manufacturer name string 20

mgmtcnt The number of unauthorized client flooding managemet uint32 10

frames

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43546 - LOG_ID_EVENT_WIRELESS_WIDS_SPOOF_DEAUTH

Message ID: 43546

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_SPOOF_DEAUTH
Message Meaning: Wireless spoofed deauthentication detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

FortiOS 6.0.10 Log Reference 725

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43548 - LOG_ID_EVENT_WIRELESS_WIDS_ASLEAP

Message ID: 43548

Message Description: LOG_ID_EVENT_WIRELESS_WIDS_ASLEAP
Message Meaning: Wireless Asleap attack detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

bssid Service Set ID string 17

FortiOS 6.0.10 Log Reference 726

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

channel Channel uint8 3

date Date string 10

devid Device ID string 16

ds direction with distribution system string 8

encrypt whether the packet is encrypted or not uint8 3

eventtime uint64 20

frametype Frame Type string 32

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rssi Received signal strength indicator uint8 3

seq Sequence string 16

sndetected SN of the AP which detected the rogue AP string 36

subtype Log Subtype string 20

tamac the MAC address of Transmitter, if none, then Receiver string 17

threattype WIDS threat type string 64

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43550 - LOG_ID_EVENT_WIRELESS_STA_LOCATE

Message ID: 43550

Message Description: LOG_ID_EVENT_WIRELESS_STA_LOCATE
Message Meaning: Wireless station presence detection
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 727

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

noise int8 4

radioband Radio Band string 64

radioid Radio ID uint8 3

signal Signal int8 4

sn Serial Number string 64

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43551 - LOG_ID_EVENT_WIRELESS_WTP_JOIN

Message ID: 43551

Message Description: LOG_ID_EVENT_WIRELESS_WTP_JOIN
Message Meaning: Physical AP join
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

FortiOS 6.0.10 Log Reference 728

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43552 - LOG_ID_EVENT_WIRELESS_WTP_LEAVE

Message ID: 43552

Message Description: LOG_ID_EVENT_WIRELESS_WTP_LEAVE
Message Meaning: Physical AP leave
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 729

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43553 - LOG_ID_EVENT_WIRELESS_WTP_FAIL

Message ID: 43553

Message Description: LOG_ID_EVENT_WIRELESS_WTP_FAIL
Message Meaning: Physical AP fail
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

FortiOS 6.0.10 Log Reference 730

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43554 - LOG_ID_EVENT_WIRELESS_WTP_UPDATE

Message ID: 43554

Message Description: LOG_ID_EVENT_WIRELESS_WTP_UPDATE
Message Meaning: Physical AP update
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 731

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43555 - LOG_ID_EVENT_WIRELESS_WTP_RESET

Message ID: 43555

Message Description: LOG_ID_EVENT_WIRELESS_WTP_RESET
Message Meaning: Physical AP reset
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

FortiOS 6.0.10 Log Reference 732

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43556 - LOG_ID_EVENT_WIRELESS_WTP_KICK

Message ID: 43556

Message Description: LOG_ID_EVENT_WIRELESS_WTP_KICK
Message Meaning: Physical AP kick
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

FortiOS 6.0.10 Log Reference 733

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43557 - LOG_ID_EVENT_WIRELESS_WTP_ADD_FAILURE

Message ID: 43557

Message Description: LOG_ID_EVENT_WIRELESS_WTP_ADD_FAILURE
Message Meaning: Physical AP add failure
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

FortiOS 6.0.10 Log Reference 734

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43558 - LOG_ID_EVENT_WIRELESS_WTP_CFG_ERR

Message ID: 43558

Message Description: LOG_ID_EVENT_WIRELESS_WTP_CFG_ERR
Message Meaning: Physical AP config error
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 735

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43559 - LOG_ID_EVENT_WIRELESS_WTP_SN_MISMATCH

Message ID: 43559

Message Description: LOG_ID_EVENT_WIRELESS_WTP_SN_MISMATCH
Message Meaning: Physical AP SN mismatch
Type: Event
Category: WIRELESS
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 736

Fortinet, Inc.
Log Messages

43560 - LOG_ID_EVENT_WIRELESS_SYS_AC_RESTARTED

Message ID: 43560

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_RESTARTED
Message Meaning: Wireless system restarted
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43561 - LOG_ID_EVENT_WIRELESS_SYS_AC_HOSTAPD_UP

Message ID: 43561

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_HOSTAPD_UP
Message Meaning: Wireless system hostapd up
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 737

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43562 - LOG_ID_EVENT_WIRELESS_SYS_AC_HOSTAPD_DOWN

Message ID: 43562

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_HOSTAPD_DOWN
Message Meaning: Wireless system hostapd down
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 738

Fortinet, Inc.
Log Messages

43563 - LOG_ID_EVENT_WIRELESS_ROGUE_DETECT

Message ID: 43563

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_DETECT
Message Meaning: Rogue AP detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

FortiOS 6.0.10 Log Reference 739

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43564 - LOG_ID_EVENT_WIRELESS_ROGUE_OFFAIR

Message ID: 43564

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_OFFAIR
Message Meaning: Rogue AP off air
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

FortiOS 6.0.10 Log Reference 740

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43565 - LOG_ID_EVENT_WIRELESS_ROGUE_ONAIR

Message ID: 43565

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_ONAIR
Message Meaning: Rogue AP on air

FortiOS 6.0.10 Log Reference 741

Fortinet, Inc.
Log Messages

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

FortiOS 6.0.10 Log Reference 742

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43566 - LOG_ID_EVENT_WIRELESS_ROGUE_OFFWIRE

Message ID: 43566

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_OFFWIRE
Message Meaning: Rogue AP off wire
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

FortiOS 6.0.10 Log Reference 743

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43567 - LOG_ID_EVENT_WIRELESS_FAKEAP_DETECT

Message ID: 43567

Message Description: LOG_ID_EVENT_WIRELESS_FAKEAP_DETECT
Message Meaning: Fake AP detected
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 744

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

FortiOS 6.0.10 Log Reference 745

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43568 - LOG_ID_EVENT_WIRELESS_FAKEAP_ONAIR

Message ID: 43568

Message Description: LOG_ID_EVENT_WIRELESS_FAKEAP_ONAIR
Message Meaning: Fake AP on air
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 746

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43569 - LOG_ID_EVENT_WIRELESS_ROGUE_SUPPRESSED

Message ID: 43569

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_SUPPRESSED
Message Meaning: Rogue AP suppressed
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

FortiOS 6.0.10 Log Reference 747

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 748

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43570 - LOG_ID_EVENT_WIRELESS_ROGUE_UNSUPPRESSED

Message ID: 43570

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_UNSUPPRESSED
Message Meaning: Rogue AP unsuppressed
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

FortiOS 6.0.10 Log Reference 749

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43571 - LOG_ID_EVENT_WIRELESS_ROGUE_DETECT_CHG

Message ID: 43571

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_DETECT_CHG
Message Meaning: Rogue AP change detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

age time in seconds - time passed since last seen uint32 10

apscan The name of the AP, which scanned and detected the rogue AP string 36

apstatus Access Point Status uint8 3

FortiOS 6.0.10 Log Reference 750

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

aptype AP Type uint8 3

bssid Service Set ID string 17

channel Channel uint8 3

date Date string 10

detectionmethod Detection Method string 21

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

level Log Level string 11

live time in seconds uint32 10

logdesc Log Description string

logid Log ID string 10

manuf Manufacturer name string 20

msg Log Message string

noise int8 4

onwire A flag to indicate if the AP is onwire or not string 3

radioband Radio Band string 64

radioidclosest Radio ID on the AP closest the rogue AP uint8 3

radioiddetected Radio ID on the AP which detected the rogue AP uint8 3

rate uint16 6

security Security string 40

signal Signal int8 4

snclosest SN of the AP closest to the rogue AP string 36

sndetected SN of the AP which detected the rogue AP string 36

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 751

Fortinet, Inc.
Log Messages

43572 - LOG_ID_EVENT_WIRELESS_STA_ASSO

Message ID: 43572

Message Description: LOG_ID_EVENT_WIRELESS_STA_ASSO
Message Meaning: Wireless client associated
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 752

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43573 - LOG_ID_EVENT_WIRELESS_STA_AUTH

Message ID: 43573

Message Description: LOG_ID_EVENT_WIRELESS_STA_AUTH
Message Meaning: Wireless client authenticated
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

FortiOS 6.0.10 Log Reference 753

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43574 - LOG_ID_EVENT_WIRELESS_STA_DASS

Message ID: 43574

Message Description: LOG_ID_EVENT_WIRELESS_STA_DASS
Message Meaning: Wireless client disassociated
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 754

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43575 - LOG_ID_EVENT_WIRELESS_STA_DAUT

Message ID: 43575

Message Description: LOG_ID_EVENT_WIRELESS_STA_DAUT
Message Meaning: Wireless client deauthenticated
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 755

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43576 - LOG_ID_EVENT_WIRELESS_STA_IDLE

Message ID: 43576

Message Description: LOG_ID_EVENT_WIRELESS_STA_IDLE
Message Meaning: Wireless client idle
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 756

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43577 - LOG_ID_EVENT_WIRELESS_STA_DENY

Message ID: 43577

Message Description: LOG_ID_EVENT_WIRELESS_STA_DENY

FortiOS 6.0.10 Log Reference 757

Fortinet, Inc.
Log Messages

Message Meaning: Wireless client denied

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 758

Fortinet, Inc.
Log Messages

43578 - LOG_ID_EVENT_WIRELESS_STA_KICK

Message ID: 43578

Message Description: LOG_ID_EVENT_WIRELESS_STA_KICK
Message Meaning: Wireless client kicked
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 759

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43579 - LOG_ID_EVENT_WIRELESS_STA_IP

Message ID: 43579

Message Description: LOG_ID_EVENT_WIRELESS_STA_IP
Message Meaning: Wireless client IP assigned
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

FortiOS 6.0.10 Log Reference 760

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43580 - LOG_ID_EVENT_WIRELESS_STA_LEAVE_WTP

Message ID: 43580

Message Description: LOG_ID_EVENT_WIRELESS_STA_LEAVE_WTP
Message Meaning: Wireless client left WTP
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 761

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43581 - LOG_ID_EVENT_WIRELESS_STA_WTP_DISCONN

Message ID: 43581

Message Description: LOG_ID_EVENT_WIRELESS_STA_WTP_DISCONN
Message Meaning: Wireless client WTP disconnected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 762

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43582 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_UNCLASSIFIED

Message ID: 43582

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_CFG_UNCLASSIFIED
Message Meaning: Rogue AP status configured as unclassified
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 763

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

apstatus Access Point Status uint8 3

bssid Service Set ID string 17

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

ssid Base Service Set ID string 33

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43583 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_ACCEPTED

Message ID: 43583

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_CFG_ACCEPTED
Message Meaning: Rogue AP status configured as accepted
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

apstatus Access Point Status uint8 3

bssid Service Set ID string 17

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 764

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

ssid Base Service Set ID string 33

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43584 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_ROGUE

Message ID: 43584

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_CFG_ROGUE
Message Meaning: Rogue AP status configured as rogue
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

apstatus Access Point Status uint8 3

bssid Service Set ID string 17

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

ssid Base Service Set ID string 33

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 765

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43585 - LOG_ID_EVENT_WIRELESS_ROGUE_CFG_SUPPRESSED

Message ID: 43585

Message Description: LOG_ID_EVENT_WIRELESS_ROGUE_CFG_SUPPRESSED
Message Meaning: Rogue AP status configured as suppressed
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

apstatus Access Point Status uint8 3

bssid Service Set ID string 17

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

ssid Base Service Set ID string 33

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43586 - LOG_ID_EVENT_WIRELESS_WTPR_DARRP_CHAN

Message ID: 43586

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_DARRP_CHAN

FortiOS 6.0.10 Log Reference 766

Fortinet, Inc.
Log Messages

Message Meaning: Physical AP radio DARRP channel change

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43587 - LOG_ID_EVENT_WIRELESS_WTPR_DARRP_START

Message ID: 43587

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_DARRP_START
Message Meaning: Physical AP radio DARRP start
Type: Event

FortiOS 6.0.10 Log Reference 767

Fortinet, Inc.
Log Messages

Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43588 - LOG_ID_EVENT_WIRELESS_WTPR_OPER_CHAN

Message ID: 43588

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_OPER_CHAN
Message Meaning: Physical AP radio operation channel change
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 768

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43589 - LOG_ID_EVENT_WIRELESS_WTPR_RADAR

Message ID: 43589

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_RADAR
Message Meaning: Physical AP radio radar detected
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 769

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43590 - LOG_ID_EVENT_WIRELESS_WTPR_NOL

Message ID: 43590

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_NOL
Message Meaning: Physical AP radio channel removed from NOL
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 770

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43591 - LOG_ID_EVENT_WIRELESS_WTPR_COUNTRY_CFG_SUCCESS

Message ID: 43591

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_COUNTRY_CFG_SUCCESS
Message Meaning: Physical AP radio country config success
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 771

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43592 - LOG_ID_EVENT_WIRELESS_WTPR_OPER_COUNTRY

Message ID: 43592

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_OPER_COUNTRY
Message Meaning: Physical AP radio operation country
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 772

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43593 - LOG_ID_EVENT_WIRELESS_WTPR_CFG_TXPOWER

Message ID: 43593

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_CFG_TXPOWER
Message Meaning: Physical AP radio config TX power
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 773

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43594 - LOG_ID_EVENT_WIRELESS_WTPR_OPER_TXPOWER

Message ID: 43594

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_OPER_TXPOWER
Message Meaning: Physical AP radio operation TX power
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 774

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43595 - LOG_ID_EVENT_WIRELESS_CLB_DENY

Message ID: 43595

Message Description: LOG_ID_EVENT_WIRELESS_CLB_DENY
Message Meaning: Wireless client load balancing denied
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 775

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

radioband Radio Band string 64

reason Reason string 256

sn Serial Number string 64

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vap string 36

vd Virtual Domain Name string 32

43596 - LOG_ID_EVENT_WIRELESS_CLB_RETRY

Message ID: 43596

Message Description: LOG_ID_EVENT_WIRELESS_CLB_RETRY
Message Meaning: Wireless client load balancing retry
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 776

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

radioband Radio Band string 64

reason Reason string 256

sn Serial Number string 64

ssid Base Service Set ID string 33

stacount Number of stations/clients uint32 10

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vap string 36

vd Virtual Domain Name string 32

43597 - LOG_ID_EVENT_WIRELESS_WTP_ADD

Message ID: 43597

Message Description: LOG_ID_EVENT_WIRELESS_WTP_ADD
Message Meaning: Physical AP add
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

FortiOS 6.0.10 Log Reference 777

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43598 - LOG_ID_EVENT_WIRELESS_WTP_ADD_XSS

Message ID: 43598

Message Description: LOG_ID_EVENT_WIRELESS_WTP_ADD_XSS
Message Meaning: Physical AP add XSS
Type: Event
Category: WIRELESS
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 778

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43599 - LOG_ID_EVENT_WIRELESS_WTP_DEL

Message ID: 43599

Message Description: LOG_ID_EVENT_WIRELESS_WTP_DEL
Message Meaning: Physical AP delete
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

FortiOS 6.0.10 Log Reference 779

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43600 - LOG_ID_EVENT_WIRELESS_WTPR_DARRP_STOP

Message ID: 43600

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_DARRP_STOP
Message Meaning: Physical AP radio DARRP stop
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 780

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43601 - LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON

Message ID: 43601

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON
Message Meaning: Wireless station sign on
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

FortiOS 6.0.10 Log Reference 781

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43602 - LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON_SUCCESS

Message ID: 43602

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON_SUCCESS
Message Meaning: Wireless station sign on success
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 782

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43603 - LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON_FAILURE

Message ID: 43603

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_SIGNON_FAILURE
Message Meaning: Wireless station sign on failed

FortiOS 6.0.10 Log Reference 783

Fortinet, Inc.
Log Messages

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 784

Fortinet, Inc.
Log Messages

43604 - LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_REQUEST

Message ID: 43604

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_REQUEST
Message Meaning: Captive-portal VAP e-mail collect request sent
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 785

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43605 - LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_SUCCESS

Message ID: 43605

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_SUCCESS
Message Meaning: Captive-portal VAP e-mail collect success
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

FortiOS 6.0.10 Log Reference 786

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43606 - LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_FAILURE

Message ID: 43606

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_EMAIL_FAILURE
Message Meaning: Captive-portal VAP e-mail collect failed
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 787

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43607 - LOG_ID_EVENT_WIRELESS_STA_CAP_DISCLAIMER_CHECK

Message ID: 43607

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_DISCLAIMER_CHECK
Message Meaning: Captive-portal VAP disclaimer agreed
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 788

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43608 - LOG_ID_EVENT_WIRELESS_STA_CAP_DISCLAIMER_DECLINE

Message ID: 43608

Message Description: LOG_ID_EVENT_WIRELESS_STA_CAP_DISCLAIMER_DECLINE
Message Meaning: Captive-portal VAP disclaimer declined
Type: Event
Category: WIRELESS
Severity: Notice

FortiOS 6.0.10 Log Reference 789

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

channel Channel uint8 3

date Date string 10

devid Device ID string 16

encryption Encryption Method string 12

eventtime uint64 20

group User Group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mpsk string 33

msg Log Message string

radioband Radio Band string 64

radioid Radio ID uint8 3

reason Reason string 256

security Security string 40

sn Serial Number string 64

srcip Source IP ip 39

ssid Base Service Set ID string 33

stamac Station/Client MAC address string 17

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vap string 36

vd Virtual Domain Name string 32

43609 - LOG_ID_EVENT_WIRELESS_SYS_AC_DARRP_START

Message ID: 43609

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_DARRP_START

FortiOS 6.0.10 Log Reference 790

Fortinet, Inc.
Log Messages

Message Meaning: DARRP optimization start

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43610 - LOG_ID_EVENT_WIRELESS_SYS_AC_DARRP_STOP

Message ID: 43610

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_DARRP_STOP
Message Meaning: DARRP optimization stop
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 791

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43611 - LOG_ID_EVENT_WIRELESS_SYS_AC_UP

Message ID: 43611

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_UP
Message Meaning: Wireless controller start
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43612 - LOG_ID_EVENT_WIRELESS_SYS_AC_CFG_LOADED

Message ID: 43612

FortiOS 6.0.10 Log Reference 792

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_CFG_LOADED

Message Meaning: Wireless controller configuration loaded
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43613 - LOG_ID_EVENT_WIRELESS_WTP_ERR

Message ID: 43613

Message Description: LOG_ID_EVENT_WIRELESS_WTP_ERR
Message Meaning: Physical AP error
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 793

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43614 - LOG_ID_EVENT_WIRELESS_DHCP_STAVATION

Message ID: 43614

Message Description: LOG_ID_EVENT_WIRELESS_DHCP_STAVATION
Message Meaning: DHCP Starvation detected
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

client_addr string 17

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 794

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

sn Serial Number string 64

source_mac string 17

ssid Base Service Set ID string 33

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vap string 36

vapmode string 17

vd Virtual Domain Name string 32

xid uint32 10

43615 - LOG_ID_EVENT_WIRELESS_SYS_AC_IPSEC_FAIL

Message ID: 43615

Message Description: LOG_ID_EVENT_WIRELESS_SYS_AC_IPSEC_FAIL
Message Meaning: Wireless controller IPsec setup failed
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 795

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43616 - LOG_ID_EVENT_WIRELESS_WTPR_NOL_ADD

Message ID: 43616

Message Description: LOG_ID_EVENT_WIRELESS_WTPR_NOL_ADD
Message Meaning: Physical AP radio NOL added
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

bandwidth Bandwidth string 42

cfgtxpower Config TX power uint32 10

configcountry Config Country string 4

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

opercountry Operating Country string 4

opertxpower Operating TX power uint32 10

radioband Radio Band string 64

FortiOS 6.0.10 Log Reference 796

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

radioid Radio ID uint8 3

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43617 - LOG_ID_EVENT_WIRELESS_WTPPROF_ADJUSTED

Message ID: 43617

Message Description: LOG_ID_EVENT_WIRELESS_WTPPROF_ADJUSTED
Message Meaning: Wireless WTP profile has been adjusted
Type: Event
Category: WIRELESS
Severity: Warning

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

profile Profile Name string 64

reason Reason string 256

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 797

Fortinet, Inc.
Log Messages

43618 - LOG_ID_EVENT_WIRELESS_WTP_IMAGE_RC_SUCCESS

Message ID: 43618

Message Description: LOG_ID_EVENT_WIRELESS_WTP_IMAGE_RC_SUCCESS
Message Meaning: Physical AP image receive success
Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43621 - LOG_ID_EVENT_WIRELESS_WTP_DATA_CHAN_CHG

Message ID: 43621

Message Description: LOG_ID_EVENT_WIRELESS_WTP_DATA_CHAN_CHG
Message Meaning: Wireless wtp data channel changed

FortiOS 6.0.10 Log Reference 798

Fortinet, Inc.
Log Messages

Type: Event
Category: WIRELESS
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

ap Access Point string 36

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

meshmode Mesh mode string 19

msg Log Message string

profile Profile Name string 64

reason Reason string 256

sn Serial Number string 64

snmeshparent SN of the mesh parent string 36

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43776 - LOG_ID_EVENT_NAC_QUARANTINE

Message ID: 43776

Message Description: LOG_ID_EVENT_NAC_QUARANTINE
Message Meaning: NAC quarantine
Type: Event
Category: SYSTEM
Severity: Notice

FortiOS 6.0.10 Log Reference 799

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

admin string 64

banned_rule NAC quarantine Banned Rule Name string 80

banned_src NAC quarantine Banned Source IP string 16

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

dst_int Destination Interface string 64

duration Duration uint32 10

eventtime uint64 20

group User group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

policyid Policy ID uint32 10

proto Protocol Number uint8 3

sensor NAC Sensor Name string 36

service Name of Service string 64

srcip Source IP ip 39

srcport Source Port uint16 5

src_int Source Interface string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

43777 - LOG_ID_EVENT_NAC_ANOMALY_QUARANTINE

Message ID: 43777

FortiOS 6.0.10 Log Reference 800

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_EVENT_NAC_ANOMALY_QUARANTINE

Message Meaning: NAC anomaly quarantine
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

admin string 64

banned_rule NAC quarantine Banned Rule Name string 80

banned_src NAC quarantine Banned Source IP string 16

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

dst_int Destination Interface string 64

duration Duration uint32 10

eventtime uint64 20

group User group Name string 64

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

policyid Policy ID uint32 10

proto Protocol Number uint8 3

sensor NAC Sensor Name string 36

service Name of Service string 64

srcip Source IP ip 39

srcport Source Port uint16 5

src_int Source Interface string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 801

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

43800 - LOG_ID_EVENT_ELBC_BLADE_JOIN

Message ID: 43800

Message Description: LOG_ID_EVENT_ELBC_BLADE_JOIN
Message Meaning: Blade ready to process traffic
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43801 - LOG_ID_EVENT_ELBC_BLADE_LEAVE

Message ID: 43801

Message Description: LOG_ID_EVENT_ELBC_BLADE_LEAVE
Message Meaning: Blade not ready to process traffic

FortiOS 6.0.10 Log Reference 802

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43802 - LOG_ID_EVENT_ELBC_MASTER_BLADE_FOUND

Message ID: 43802

Message Description: LOG_ID_EVENT_ELBC_MASTER_BLADE_FOUND
Message Meaning: Master blade found
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

FortiOS 6.0.10 Log Reference 803

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43803 - LOG_ID_EVENT_ELBC_MASTER_BLADE_LOST

Message ID: 43803

Message Description: LOG_ID_EVENT_ELBC_MASTER_BLADE_LOST
Message Meaning: Master blade lost
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 804

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43804 - LOG_ID_EVENT_ELBC_MASTER_BLADE_CHANGE

Message ID: 43804

Message Description: LOG_ID_EVENT_ELBC_MASTER_BLADE_CHANGE
Message Meaning: Master blade changed
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

newchassisid New Chassis ID uint8

newslot New Slot Number uint8

oldchassisid Original Chassis Number uint8

oldslot Original Slot Number uint8

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 805

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

43805 - LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_FOUND

Message ID: 43805

Message Description: LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_FOUND
Message Meaning: ELBC channel active
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

newchannel New Channel Number uint8

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43806 - LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_LOST

Message ID: 43806

Message Description: LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_LOST

FortiOS 6.0.10 Log Reference 806

Fortinet, Inc.
Log Messages

Message Meaning: ELBC channel inactive

Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

oldchannel Original Channel Number uint8

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43807 - LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_CHANGE

Message ID: 43807

Message Description: LOG_ID_EVENT_ELBC_ACTIVE_CHANNEL_CHANGE
Message Meaning: ELBC channel failover
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 807

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

newchannel New Channel Number uint8

oldchannel Original Channel Number uint8

slot Slot Number uint8

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43808 - LOG_ID_EVENT_ELBC_CHASSIS_ACTIVE

Message ID: 43808

Message Description: LOG_ID_EVENT_ELBC_CHASSIS_ACTIVE
Message Meaning: ELBC chassis active
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 808

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

43809 - LOG_ID_EVENT_ELBC_CHASSIS_INACTIVE

Message ID: 43809

Message Description: LOG_ID_EVENT_ELBC_CHASSIS_INACTIVE
Message Meaning: ELBC chassis inactive
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

action Action string 32

chassisid Chassis ID uint8

date Date string 10

devid Device ID string 16

eventtime uint64 20

informationsource Information Source string

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 809

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

44544 - LOGID_EVENT_CONFIG_PATH

Message ID: 44544

Message Description: LOGID_EVENT_CONFIG_PATH
Message Meaning: Path configured
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44545 - LOGID_EVENT_CONFIG_OBJ

Message ID: 44545

Message Description: LOGID_EVENT_CONFIG_OBJ

FortiOS 6.0.10 Log Reference 810

Fortinet, Inc.
Log Messages

Message Meaning: Object configured

Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44546 - LOGID_EVENT_CONFIG_ATTR

Message ID: 44546

Message Description: LOGID_EVENT_CONFIG_ATTR
Message Meaning: Attribute configured
Type: Event
Category: SYSTEM
Severity: Information

FortiOS 6.0.10 Log Reference 811

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

cfgattr configuration attribute string

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44547 - LOGID_EVENT_CONFIG_OBJATTR

Message ID: 44547

Message Description: LOGID_EVENT_CONFIG_OBJATTR
Message Meaning: Object attribute configured
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

FortiOS 6.0.10 Log Reference 812

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44548 - LOGID_EVENT_CONFIG_EXEC

Message ID: 44548

Message Description: LOGID_EVENT_CONFIG_EXEC
Message Meaning: Action performed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 813

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44549 - LOGID_EVENT_CONFIG_OBJATTR_MTNER

Message ID: 44549

Message Description: LOGID_EVENT_CONFIG_OBJATTR_MTNER
Message Meaning: Object attribute configured by maintainer
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

cfgattr configuration attribute string

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 814

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44550 - LOGID_EVENT_CONFIG_OBJ_MTNER

Message ID: 44550

Message Description: LOGID_EVENT_CONFIG_OBJ_MTNER
Message Meaning: Object configured by maintainer
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

cfgobj configuration object string 256

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 815

Fortinet, Inc.
Log Messages

44551 - LOGID_EVENT_CONFIG_ATTR_MTNER

Message ID: 44551

Message Description: LOGID_EVENT_CONFIG_ATTR_MTNER
Message Meaning: Attribute configured by maintainer
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

cfgattr configuration attribute string

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44552 - LOGID_EVENT_CONFIG_PATH_MTNER

Message ID: 44552

Message Description: LOGID_EVENT_CONFIG_PATH_MTNER
Message Meaning: Path configured by maintainer
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 816

Fortinet, Inc.
Log Messages

Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

cfgpath configuration path string 128

cfgtid config transaction id uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

44553 - LOGID_EVENT_CONFIG_FIXEDPORT_DIS

Message ID: 44553

Message Description: LOGID_EVENT_CONFIG_FIXEDPORT_DIS
Message Meaning: Policy attribute fixed port changed during upgrade
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 817

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

policyid Policy ID uint32 10

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45057 - LOG_ID_FCC_ADD

Message ID: 45057

Message Description: LOG_ID_FCC_ADD
Message Meaning: FortiClient connection added
Type: Event
Category: ENDPOINT
Severity: Information

Log Field Name Description Data Type Length

action EndPoint Action string 32

connection_type FortiClient Connection Type string 6

count Count of EndPoint Connections uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

ip Source IP ip 39

level Log Level string 11

license_limit Maximum Number of FortiClients for the License string 32

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 818

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

name Display Name of the Connection string 128

status Status string 23

subtype Log subtype string 20

time Time string 8

type Log Type string 16

used_for_type Connection for the type uint32 10

user User Name string 256

vd Virtual Domain Name string 32

45058 - LOG_ID_FCC_CLOSE

Message ID: 45058

Message Description: LOG_ID_FCC_CLOSE
Message Meaning: FortiClient connection closed
Type: Event
Category: ENDPOINT
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

subtype Log subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45061 - LOG_ID_FCC_CLOSE_BY_TYPE

Message ID: 45061

FortiOS 6.0.10 Log Reference 819

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_FCC_CLOSE_BY_TYPE

Message Meaning: FortiClient connection closed by type
Type: Event
Category: ENDPOINT
Severity: Information

Log Field Name Description Data Type Length

action EndPoint Action string 32

connection_type FortiClient Connection Type string 6

count Count of EndPoint Connections uint32 10

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

ip Source IP ip 39

level Log Level string 11

license_limit Maximum Number of FortiClients for the License string 32

logdesc Log Description string

logid Log ID string 10

msg Log Message string

name Display Name of the Connection string 128

status Status string 23

subtype Log subtype string 20

time Time string 8

type Log Type string 16

used_for_type Connection for the type uint32 10

user User Name string 256

vd Virtual Domain Name string 32

45071 - LOG_ID_FCC_VULN_SCAN

Message ID: 45071

Message Description: LOG_ID_FCC_VULN_SCAN
Message Meaning: FortiClient Vulnerability Scan
Type: Event

FortiOS 6.0.10 Log Reference 820

Fortinet, Inc.
Log Messages

Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

cveid CVE ID string 720

date Date string 10

devid Device ID string 16

devtype string 32

eventtime uint64 20

fctuid string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

scantime uint64 20

severity string 10

srcip ip 39

srcmac string 17

srcname string 64

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

vendorurl string 256

vulncat Vulnerability Category string 32

vulnid uint32 10

vulnname string 128

45081 - LOG_ID_FCC_COMPL_CHANGE

Message ID: 45081

Message Description: LOG_ID_FCC_COMPL_CHANGE
Message Meaning: FortiClient compliance state changed

FortiOS 6.0.10 Log Reference 821

Fortinet, Inc.
Log Messages

Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devtype string 32

dstip ip 39

dstport uint16 5

eventtime uint64 20

fctuid string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

srcip ip 39

srcmac string 17

srcname string 64

srcport uint16 5

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45082 - LOG_ID_FCC_NOT_COMPL

Message ID: 45082

Message Description: LOG_ID_FCC_NOT_COMPL
Message Meaning: FortiClient not compliant
Type: Event
Category: ENDPOINT
Severity: Information

FortiOS 6.0.10 Log Reference 822

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

devtype string 32

dstip ip 39

dstport uint16 5

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

srcip ip 39

srcmac string 17

srcport uint16 5

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45083 - LOG_ID_FCC_NOT_COMPL_DEBUG

Message ID: 45083

Message Description: LOG_ID_FCC_NOT_COMPL_DEBUG
Message Meaning: FortiClient not compliant debug message
Type: Event
Category: ENDPOINT
Severity: Debug

Log Field Name Description Data Type Length

date Date string 10

FortiOS 6.0.10 Log Reference 823

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

devtype string 32

dstip ip 39

dstport uint16 5

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

srcip ip 39

srcmac string 17

srcport uint16 5

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45084 - LOG_ID_FCC_SIG_IDS_DETAILS

Message ID: 45084

Message Description: LOG_ID_FCC_SIG_IDS_DETAILS
Message Meaning: FortiClient signatures details
Type: Event
Category: ENDPOINT
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

FortiOS 6.0.10 Log Reference 824

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devtype string 32

dstip ip 39

dstport uint16 5

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

srcip ip 39

srcmac string 17

srcname string 64

srcport uint16 5

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45100 - LOG_ID_EC_REG_FAIL_LIMIT

Message ID: 45100

Message Description: LOG_ID_EC_REG_FAIL_LIMIT
Message Meaning: FortiClient registration failed
Type: Event
Category: ENDPOINT
Severity: Warning

FortiOS 6.0.10 Log Reference 825

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45101 - LOG_ID_EC_REG_SUCCEED

Message ID: 45101

Message Description: LOG_ID_EC_REG_SUCCEED
Message Meaning: FortiClient registered
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

FortiOS 6.0.10 Log Reference 826

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45102 - LOG_ID_EC_REG_RENEWED

Message ID: 45102

Message Description: LOG_ID_EC_REG_RENEWED
Message Meaning: FortiClient registration renewed
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 827

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45103 - LOG_ID_EC_REG_BLOCK

Message ID: 45103

Message Description: LOG_ID_EC_REG_BLOCK
Message Meaning: FortiClient registration blocked
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45104 - LOG_ID_EC_REG_UNBLOCK

Message ID: 45104

Message Description: LOG_ID_EC_REG_UNBLOCK

FortiOS 6.0.10 Log Reference 828

Fortinet, Inc.
Log Messages

Message Meaning: FortiClient registration unblocked

Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45105 - LOG_ID_EC_REG_DEREG

Message ID: 45105

Message Description: LOG_ID_EC_REG_DEREG
Message Meaning: FortiClient deregistered
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

level Log Level string 11

FortiOS 6.0.10 Log Reference 829

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45106 - LOG_ID_EC_REG_LIC_UPGRADED

Message ID: 45106

Message Description: LOG_ID_EC_REG_LIC_UPGRADED
Message Meaning: FortiClient registration license upgraded
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45107 - LOG_ID_EC_CONF_DISTRIBUTED

Message ID: 45107

Message Description: LOG_ID_EC_CONF_DISTRIBUTED

FortiOS 6.0.10 Log Reference 830

Fortinet, Inc.
Log Messages

Message Meaning: FortiClient configuration distributed

Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45108 - LOG_ID_EC_FTCL_UNREG

Message ID: 45108

Message Description: LOG_ID_EC_FTCL_UNREG
Message Meaning: FortiClient unregistered
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

FortiOS 6.0.10 Log Reference 831

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45109 - LOG_ID_EC_FTCL_LOGOFF

Message ID: 45109

Message Description: LOG_ID_EC_FTCL_LOGOFF
Message Meaning: FortiClient logged off
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

FortiOS 6.0.10 Log Reference 832

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45110 - LOG_ID_EC_FTCL_ENABLE_NOTSYNC

Message ID: 45110

Message Description: LOG_ID_EC_FTCL_ENABLE_NOTSYNC
Message Meaning: FortiClient synchronization disabled
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

FortiOS 6.0.10 Log Reference 833

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45111 - LOG_ID_EC_REG_SYNC_FAIL

Message ID: 45111

Message Description: LOG_ID_EC_REG_SYNC_FAIL
Message Meaning: FortiClient synchronization failed
Type: Event
Category: ENDPOINT
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 834

Fortinet, Inc.
Log Messages

45112 - LOG_ID_EC_REG_FAIL_KEY

Message ID: 45112

Message Description: LOG_ID_EC_REG_FAIL_KEY
Message Meaning: FortiClient registration failed due to wrong registration key
Type: Event
Category: ENDPOINT
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45113 - LOG_ID_EC_REG_FAIL_BLOCKED

Message ID: 45113

Message Description: LOG_ID_EC_REG_FAIL_BLOCKED
Message Meaning: FortiClient registration failed due to blocked UID
Type: Event
Category: ENDPOINT
Severity: Warning

FortiOS 6.0.10 Log Reference 835

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45114 - LOG_ID_EC_REG_QUARANTINE

Message ID: 45114

Message Description: LOG_ID_EC_REG_QUARANTINE
Message Meaning: FortiClient endpoint quarantined
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

FortiOS 6.0.10 Log Reference 836

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45115 - LOG_ID_EC_REG_UNQUARANTINE

Message ID: 45115

Message Description: LOG_ID_EC_REG_UNQUARANTINE
Message Meaning: FortiClient endpoint quarantine removed
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

FortiOS 6.0.10 Log Reference 837

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45116 - LOG_ID_EC_REG_UNQUARANTINE_ALL

Message ID: 45116

Message Description: LOG_ID_EC_REG_UNQUARANTINE_ALL
Message Meaning: All FortiClient endpoint quarantines removed
Type: Event
Category: ENDPOINT
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45117 - LOG_ID_EC_REG_FAIL_VER

Message ID: 45117

Message Description: LOG_ID_EC_REG_FAIL_VER
Message Meaning: FortiClient registration failed due to version too low
Type: Event
Category: ENDPOINT

FortiOS 6.0.10 Log Reference 838

Fortinet, Inc.
Log Messages

Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45118 - LOG_ID_EC_REG_FAIL_UNSUPPORTED

Message ID: 45118

Message Description: LOG_ID_EC_REG_FAIL_UNSUPPORTED
Message Meaning: FortiClient registration failed due to unsupported route
Type: Event
Category: ENDPOINT
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

fctuid string 32

FortiOS 6.0.10 Log Reference 839

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

hostname Endpoint Hostname string 128

interface Interface string 32

ip Source IP ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

subtype Log subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

45151 - LOG_ID_EVENT_DSSCC_FAIL

Message ID: 45151

Message Description: LOG_ID_EVENT_DSSCC_FAIL
Message Meaning: PCI DSS compliance check failed
Type: Event
Category: COMPLIANCE-CHECK
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

module Module string 32

msg Log Message string

FortiOS 6.0.10 Log Reference 840

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

reason Reason string 256

result Result string 31

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

45152 - LOG_ID_EVENT_DSSCC_PASS

Message ID: 45152

Message Description: LOG_ID_EVENT_DSSCC_PASS
Message Meaning: PCI DSS compliance check passed
Type: Event
Category: COMPLIANCE-CHECK
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

module Module string 32

msg Log Message string

reason Reason string 256

result Result string 31

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 841

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

45161 - LOG_ID_EVENT_DSSCC_EXEC

Message ID: 45161

Message Description: LOG_ID_EVENT_DSSCC_EXEC
Message Meaning: PCI DSS compliance check executed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

ui User Interface string 64

user User Name string 256

vd Virtual Domain Name string 32

46000 - LOG_ID_VIP_REAL_SVR_ENA

Message ID: 46000

Message Description: LOG_ID_VIP_REAL_SVR_ENA
Message Meaning: VIP real server enabled
Type: Event

FortiOS 6.0.10 Log Reference 842

Fortinet, Inc.
Log Messages

Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vip Virtual IP string 64

46001 - LOG_ID_VIP_REAL_SVR_DISA

Message ID: 46001

Message Description: LOG_ID_VIP_REAL_SVR_DISA
Message Meaning: VIP real server disabled
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 843

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vip Virtual IP string 64

46002 - LOG_ID_VIP_REAL_SVR_UP

Message ID: 46002

Message Description: LOG_ID_VIP_REAL_SVR_UP
Message Meaning: VIP real server up
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

FortiOS 6.0.10 Log Reference 844

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vip Virtual IP string 64

46003 - LOG_ID_VIP_REAL_SVR_DOWN

Message ID: 46003

Message Description: LOG_ID_VIP_REAL_SVR_DOWN
Message Meaning: VIP real server down
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 845

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd Virtual Domain Name string 32

vip Virtual IP string 64

46004 - LOG_ID_VIP_REAL_SVR_ENT_HOLDDOWN

Message ID: 46004

Message Description: LOG_ID_VIP_REAL_SVR_ENT_HOLDDOWN
Message Meaning: VIP real server entered hold-down
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vip Virtual IP string 64

46005 - LOG_ID_VIP_REAL_SVR_FAIL_HOLDDOWN

Message ID: 46005

Message Description: LOG_ID_VIP_REAL_SVR_FAIL_HOLDDOWN

FortiOS 6.0.10 Log Reference 846

Fortinet, Inc.
Log Messages

Message Meaning: VIP real server health check failed during hold-down
Type: Event
Category: SYSTEM
Severity: Alert

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vip Virtual IP string 64

46006 - LOG_ID_VIP_REAL_SVR_FAIL

Message ID: 46006

Message Description: LOG_ID_VIP_REAL_SVR_FAIL
Message Meaning: VIP real server health check failed
Type: Event
Category: SYSTEM
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 847

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

monitor-name Health Monitor Type string 35

monitor-type Health Monitor Name string 32

msg Message Text string

port Port Number uint16 5

server Server IP Address string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

vip Virtual IP string 64

46400 - LOG_ID_EVENT_EXT_SYS

Message ID: 46400

Message Description: LOG_ID_EVENT_EXT_SYS
Message Meaning: FortiExtender system activity
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 848

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46401 - LOG_ID_EVENT_EXT_LOCAL

Message ID: 46401

Message Description: LOG_ID_EVENT_EXT_LOCAL
Message Meaning: FortiExtender AC activity
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 849

Fortinet, Inc.
Log Messages

46402 - LOG_ID_EVENT_EXT_REMOTE

Message ID: 46402

Message Description: LOG_ID_EVENT_EXT_REMOTE
Message Meaning: Remote FortiExtender activity
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46403 - LOG_ID_EVENT_EXT_LOCAL_ERROR

Message ID: 46403

Message Description: LOG_ID_EVENT_EXT_LOCAL_ERROR
Message Meaning: FortiExtender AC activity error
Type: Event
Category: SYSTEM
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 850

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

ip ip 39

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

sn Serial Number string 64

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46501 - LOG_ID_INTERNAL_LTE_MODEM_DETECTION

Message ID: 46501

Message Description: LOG_ID_INTERNAL_LTE_MODEM_DETECTION
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 851

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46502 - LOG_ID_INTERNAL_LTE_MODEM_GPSD

Message ID: 46502

Message Description: LOG_ID_INTERNAL_LTE_MODEM_GPSD
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46503 - LOG_ID_INTERNAL_LTE_MODEM_GPS_LOC_ACQUISITION

Message ID: 46503

Message Description: LOG_ID_INTERNAL_LTE_MODEM_GPS_LOC_ACQUISITION
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

FortiOS 6.0.10 Log Reference 852

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46504 - LOG_ID_INTERNAL_LTE_MODEM_BILLD

Message ID: 46504

Message Description: LOG_ID_INTERNAL_LTE_MODEM_BILLD
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 853

Fortinet, Inc.
Log Messages

46505 - LOG_ID_INTERNAL_LTE_MODEM_BILLING_PURGED

Message ID: 46505

Message Description: LOG_ID_INTERNAL_LTE_MODEM_BILLING_PURGED
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46506 - LOG_ID_INTERNAL_LTE_MODEM_BILLING_DAILY_LOG

Message ID: 46506

Message Description: LOG_ID_INTERNAL_LTE_MODEM_BILLING_DAILY_LOG
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

FortiOS 6.0.10 Log Reference 854

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46507 - LOG_ID_INTERNAL_LTE_MODEM_FW_UPGRADE

Message ID: 46507

Message Description: LOG_ID_INTERNAL_LTE_MODEM_FW_UPGRADE
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46508 - LOG_ID_INTERNAL_LTE_MODEM_QDL_DETECTION

Message ID: 46508

FortiOS 6.0.10 Log Reference 855

Fortinet, Inc.
Log Messages

Message Description: LOG_ID_INTERNAL_LTE_MODEM_QDL_DETECTION

Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46509 - LOG_ID_INTERNAL_LTE_MODEM_REBOOT

Message ID: 46509

Message Description: LOG_ID_INTERNAL_LTE_MODEM_REBOOT
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

FortiOS 6.0.10 Log Reference 856

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46510 - LOG_ID_INTERNAL_LTE_MODEM_OP_MODE

Message ID: 46510

Message Description: LOG_ID_INTERNAL_LTE_MODEM_OP_MODE
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46511 - LOG_ID_INTERNAL_LTE_MODEM_POWER_ON_OFF

Message ID: 46511

Message Description: LOG_ID_INTERNAL_LTE_MODEM_POWER_ON_OFF
Message Meaning: Log description is not available

FortiOS 6.0.10 Log Reference 857

Fortinet, Inc.
Log Messages

Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46512 - LOG_ID_INTERNAL_LTE_MODEM_SIM_STATE

Message ID: 46512

Message Description: LOG_ID_INTERNAL_LTE_MODEM_SIM_STATE
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

FortiOS 6.0.10 Log Reference 858

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46513 - LOG_ID_INTERNAL_LTE_MODEM_LINK_CONNECTION

Message ID: 46513

Message Description: LOG_ID_INTERNAL_LTE_MODEM_LINK_CONNECTION
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46514 - LOG_ID_INTERNAL_LTE_MODEM_MANUAL_HANDOVER

Message ID: 46514

Message Description: LOG_ID_INTERNAL_LTE_MODEM_MANUAL_HANDOVER
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 859

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

46515 - LOG_ID_INTERNAL_LTE_MODEM_IP_ADDR

Message ID: 46515

Message Description: LOG_ID_INTERNAL_LTE_MODEM_IP_ADDR
Message Meaning: Log description is not available
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 860

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

46600 - LOG_ID_EVENT_AUTOMATION_TRIGGERED

Message ID: 46600

Message Description: LOG_ID_EVENT_AUTOMATION_TRIGGERED
Message Meaning: Automation stitch triggered
Type: Event
Category: SYSTEM
Severity: Notice

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

stitch string 36

subtype Log Subtype string 20

time Time string 8

trigger string 36

type Log Type string 16

vd Virtual Domain Name string 32

46900 - LOG_ID_POE_STATUS_REPORT

Message ID: 46900

Message Description: LOG_ID_POE_STATUS_REPORT
Message Meaning: PoE device status reported
Type: Event
Category: SYSTEM

FortiOS 6.0.10 Log Reference 861

Fortinet, Inc.
Log Messages

Severity: Error

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

47203 - LOG_ID_ENTER_BYPASS

Message ID: 47203

Message Description: LOG_ID_ENTER_BYPASS
Message Meaning: Bypass ports pair entered bypass mode
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 862

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

47204 - LOG_ID_EXIT_BYPASS

Message ID: 47204

Message Description: LOG_ID_EXIT_BYPASS
Message Meaning: Bypass ports pair exited bypass mode
Type: Event
Category: SYSTEM
Severity: Emergency

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48000 - LOG_ID_WAD_SSL_RCV_HS

Message ID: 48000

Message Description: LOG_ID_WAD_SSL_RCV_HS
Message Meaning: SSL handshake received
Type: Event
Category: WAD
Severity: Debug

FortiOS 6.0.10 Log Reference 863

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

handshake Handshake string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48001 - LOG_ID_WAD_SSL_RCV_WRG_HS

Message ID: 48001

Message Description: LOG_ID_WAD_SSL_RCV_WRG_HS
Message Meaning: SSL handshake message incorrect
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 864

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48002 - LOG_ID_WAD_SSL_SENT_HS

Message ID: 48002

Message Description: LOG_ID_WAD_SSL_SENT_HS
Message Meaning: SSL handshake sent
Type: Event
Category: WAD
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 865

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

handshake Handshake string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48003 - LOG_ID_WAD_SSL_WRG_HS_LEN

Message ID: 48003

Message Description: LOG_ID_WAD_SSL_WRG_HS_LEN
Message Meaning: SSL handshake length invalid
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

handshake Handshake string 32

FortiOS 6.0.10 Log Reference 866

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48004 - LOG_ID_WAD_SSL_RCV_CCS

Message ID: 48004

Message Description: LOG_ID_WAD_SSL_RCV_CCS
Message Meaning: SSL ChangeCipherSpec received
Type: Event
Category: WAD
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 867

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48005 - LOG_ID_WAD_SSL_RSA_DH_FAIL

Message ID: 48005

Message Description: LOG_ID_WAD_SSL_RSA_DH_FAIL
Message Meaning: RSA verification of Diffie-Hellman parameters failed
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

FortiOS 6.0.10 Log Reference 868

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48006 - LOG_ID_WAD_SSL_SENT_CCS

Message ID: 48006

Message Description: LOG_ID_WAD_SSL_SENT_CCS
Message Meaning: SSL ChangeCipherSpec sent
Type: Event
Category: WAD
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 869

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48007 - LOG_ID_WAD_SSL_BAD_HASH

Message ID: 48007

Message Description: LOG_ID_WAD_SSL_BAD_HASH
Message Meaning: SSL Finished hash mismatch
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

ssllocal string 76

sslremote string 76

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 870

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

48009 - LOG_ID_WAD_SSL_DECRY_FAIL

Message ID: 48009

Message Description: LOG_ID_WAD_SSL_DECRY_FAIL
Message Meaning: SSL decryption failed
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

reason Reason string 256

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 871

Fortinet, Inc.
Log Messages

48011 - LOG_ID_WAD_SSL_LESS_MINOR

Message ID: 48011

Message Description: LOG_ID_WAD_SSL_LESS_MINOR
Message Meaning: SSL minor version less than configured minimum value
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48013 - LOG_ID_WAD_SSL_NOT_SUPPORT_CS

Message ID: 48013

Message Description: LOG_ID_WAD_SSL_NOT_SUPPORT_CS
Message Meaning: SSL Cipher Suites not supported
Type: Event

FortiOS 6.0.10 Log Reference 872

Fortinet, Inc.
Log Messages

Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48016 - LOG_ID_WAD_SSL_HS_FIN

Message ID: 48016

Message Description: LOG_ID_WAD_SSL_HS_FIN
Message Meaning: SSL handshake completed
Type: Event
Category: WAD
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

FortiOS 6.0.10 Log Reference 873

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48017 - LOG_ID_WAD_SSL_HS_TOO_LONG

Message ID: 48017

Message Description: LOG_ID_WAD_SSL_HS_TOO_LONG
Message Meaning: SSL handshake too long
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 874

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

handshake Handshake string 32

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48019 - LOG_ID_WAD_SSL_SENT_ALERT

Message ID: 48019

Message Description: LOG_ID_WAD_SSL_SENT_ALERT
Message Meaning: SSL alert sent
Type: Event
Category: WAD
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

alert Alert string 256

date Date string 10

desc Description string 128

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 875

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48023 - LOG_ID_WAD_SSL_RCV_ALERT

Message ID: 48023

Message Description: LOG_ID_WAD_SSL_RCV_ALERT
Message Meaning: SSL alert received
Type: Event
Category: WAD
Severity: Debug

Log Field Name Description Data Type Length

action Action string 32

alert Alert string 256

date Date string 10

desc Description string 128

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 876

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48027 - LOG_ID_WAD_SSL_INVALID_CONT_TYPE

Message ID: 48027

Message Description: LOG_ID_WAD_SSL_INVALID_CONT_TYPE
Message Meaning: SSL Content Type invalid
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

FortiOS 6.0.10 Log Reference 877

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48029 - LOG_ID_WAD_SSL_BAD_CCS_LEN

Message ID: 48029

Message Description: LOG_ID_WAD_SSL_BAD_CCS_LEN
Message Meaning: SSL ChangeCipherSpec length invalid
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

FortiOS 6.0.10 Log Reference 878

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48031 - LOG_ID_WAD_SSL_BAD_DH

Message ID: 48031

Message Description: LOG_ID_WAD_SSL_BAD_DH
Message Meaning: SSL Diffie-Hellman value invalid
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 879

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48032 - LOG_ID_WAD_SSL_PUB_KEY_TOO_BIG

Message ID: 48032

Message Description: LOG_ID_WAD_SSL_PUB_KEY_TOO_BIG
Message Meaning: Certificate's public key too long
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 880

Fortinet, Inc.
Log Messages

48034 - LOG_ID_WAD_SSL_SERVER_KEY_HASH_ALGORITHM_MISMATCH

Message ID: 48034

Message Description: LOG_ID_WAD_SSL_SERVER_KEY_HASH_ALGORITHM_MISMATCH
Message Meaning: Server Key Exchange hash algorithm mismatch
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

received uint8

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48035 - LOG_ID_WAD_SSL_SERVER_KEY_SIGNATURE_ALGORITHM_
MISMATCH

Message ID: 48035

Message Description: LOG_ID_WAD_SSL_SERVER_KEY_SIGNATURE_ALGORITHM_MISMATCH

FortiOS 6.0.10 Log Reference 881

Fortinet, Inc.
Log Messages

Message Meaning: Server Key Exchange signature algorithm mismatch

Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

expectedsignature uint8

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

receivedsignature uint8

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48038 - LOG_ID_WAD_SSL_RCV_FATAL_ALERT

Message ID: 48038

Message Description: LOG_ID_WAD_SSL_RCV_FATAL_ALERT
Message Meaning: SSL Fatal Alert received
Type: Event
Category: WAD
Severity: Error

FortiOS 6.0.10 Log Reference 882

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Action string 32

alert Alert string 256

date Date string 10

desc Description string 128

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48039 - LOG_ID_WAD_SSL_SENT_FATAL_ALERT

Message ID: 48039

Message Description: LOG_ID_WAD_SSL_SENT_FATAL_ALERT
Message Meaning: SSL fatal alert sent
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 883

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

alert Alert string 256

date Date string 10

desc Description string 128

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48101 - LOG_ID_WAD_AUTH_FAIL_PSK

Message ID: 48101

Message Description: LOG_ID_WAD_AUTH_FAIL_PSK
Message Meaning: WAN Optimization peer PSK authentication failed
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

authgrp Authorization Group string 36

date Date string 10

FortiOS 6.0.10 Log Reference 884

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

host Host Name string 256

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

serial Serial Number uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48102 - LOG_ID_WAD_AUTH_FAIL_OTH

Message ID: 48102

Message Description: LOG_ID_WAD_AUTH_FAIL_OTH
Message Meaning: WAN Optimization peer authentication failed
Type: Event
Category: WAD
Severity: Error

Log Field Name Description Data Type Length

authgrp Authorization Group string 36

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

FortiOS 6.0.10 Log Reference 885

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

peer string 36

policyid Policy ID uint32 10

serial Serial Number uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48300 - LOG_ID_WRG_SVR_FGT_CONF

Message ID: 48300

Message Description: LOG_ID_WRG_SVR_FGT_CONF
Message Meaning: Server side WAN Optimization FortiGate configured incorrectly
Type: Event
Category: WAD
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

FortiOS 6.0.10 Log Reference 886

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logdesc Log Description string

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

48301 - LOG_ID_UNEXP_APP_TYPE

Message ID: 48301

Message Description: LOG_ID_UNEXP_APP_TYPE
Message Meaning: Unexpected application type for WAN Optimization
Type: Event
Category: WAD
Severity: Critical

Log Field Name Description Data Type Length

app-type Address Type string 64

date Date string 10

devid Device ID string 16

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Log Message string

FortiOS 6.0.10 Log Reference 887

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Policy ID uint32 10

session_id Session ID uint32 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

51000 - LOG_ID_NB_TBL_CHG

Message ID: 51000

Message Description: LOG_ID_NB_TBL_CHG
Message Meaning: Neighbor table changed
Type: Event
Category: ROUTER
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

mac Mac Address string 17

msg Message string

service Name of Service string 64

srcip ip 39

src_int Source Interface string 64

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 888

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

52000 - LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_SUMMARY

Message ID: 52000

Message Description: LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_SUMMARY
Message Meaning: Security Rating summary
Type: Event
Category: SECURITY-RATING
Severity: Notice

Log Field Name Description Data Type Length

auditid uint64

auditscore string 20

audittime uint64

criticalcount uint32

date string 10

devid string 16

eventtime uint64 20

highcount uint32

level string 11

logdesc string

logid string 10

lowcount uint32

mediumcount uint32

passedcount uint32

subtype string 20

time string 8

type string 16

vd string 32

FortiOS 6.0.10 Log Reference 889

Fortinet, Inc.
Log Messages

53000 - LOG_ID_SDNC_CONNECTED

Message ID: 53000

Message Description: LOG_ID_SDNC_CONNECTED
Message Meaning: Connected to SDN server
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

53001 - LOG_ID_SDNC_DISCONNECTED

Message ID: 53001

Message Description: LOG_ID_SDNC_DISCONNECTED
Message Meaning: Disconnected from SDN server
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

action Action string 32

FortiOS 6.0.10 Log Reference 890

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

user User Name string 256

vd Virtual Domain Name string 32

53002 - LOG_ID_SDNC_SUBSCRIBE

Message ID: 53002

Message Description: LOG_ID_SDNC_SUBSCRIBE
Message Meaning: Dynamic SDN address channel opened
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 891

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log Type string 16

vd Virtual Domain Name string 32

53003 - LOG_ID_SDNC_UNSUBSCRIBE

Message ID: 53003

Message Description: LOG_ID_SDNC_UNSUBSCRIBE
Message Meaning: Dynamic SDN address channel closed
Type: Event
Category: SYSTEM
Severity: Information

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

99951 - LOG_ID_NP6_IPSEC_ENGINE_BUSY

Message ID: 99951

Message Description: LOG_ID_NP6_IPSEC_ENGINE_BUSY
Message Meaning: NP6 IPsec engine is busy
Type: Event
Category: SYSTEM
Severity: Information

FortiOS 6.0.10 Log Reference 892

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

99952 - LOG_ID_NP6_IPSEC_ENGINE_POSSIBLY_LOCKUP

Message ID: 99952

Message Description: LOG_ID_NP6_IPSEC_ENGINE_POSSIBLY_LOCKUP
Message Meaning: NP6 IPsec engine is possibly locked up
Type: Event
Category: SYSTEM
Severity: Warning

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 893

Fortinet, Inc.
Log Messages

99953 - LOG_ID_NP6_IPSEC_ENGINE_LOCKUP

Message ID: 99953

Message Description: LOG_ID_NP6_IPSEC_ENGINE_LOCKUP
Message Meaning: NP6 IPsec engine is locked up
Type: Event
Category: SYSTEM
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

devid Device ID string 16

eventtime uint64 20

level Log Level string 11

logdesc Log Description string

logid Log ID string 10

msg Message Text string

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

vd Virtual Domain Name string 32

GTP

41216 - LOGID_GTP_FORWARD

Message ID: 41216

Message Description: LOGID_GTP_FORWARD
Message Meaning: GTP forward
Type: GTP
Category: GTP-ALL
Severity: Information

FortiOS 6.0.10 Log Reference 894

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-gsn Control Plane GSN ip 39

date Date string 10

dstport Destination Port uint16 5

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

linked-nsapi Linked Netscape Server Application Programming Interface uint8 3

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

nsapi Netscape Server Application Programming Interface uint8 3

profile Profile Name string 64

rai string 32

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-gsn User Plane GSN ip 39

uli string 32

FortiOS 6.0.10 Log Reference 895

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd Virtual Domain Name string 32

version Version uint32 64

41217 - LOGID_GTP_DENY

Message ID: 41217

Message Description: LOGID_GTP_DENY
Message Meaning: GTP deny
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-gsn Control Plane GSN ip 39

date Date string 10

deny_cause Deny Cause string 25

dstport Destination Port uint16 5

dtlexp Detailed Explanation string 64

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

ietype Malformed GTP IE number uint8 3

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

linked-nsapi Linked Netscape Server Application Programming Interface uint8 3

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

nsapi Netscape Server Application Programming Interface uint8 3

FortiOS 6.0.10 Log Reference 896

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile Profile Name string 64

rai string 32

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-gsn User Plane GSN ip 39

uli string 32

vd Virtual Domain Name string 32

version Version uint32 64

41218 - LOGID_GTP_RATE_LIMIT

Message ID: 41218

Message Description: LOGID_GTP_RATE_LIMIT
Message Meaning: GTP rate limit
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-gsn Control Plane GSN ip 39

date Date string 10

dstport Destination Port uint16 5

end-usr-address End user IP Address ip 39

FortiOS 6.0.10 Log Reference 897

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

linked-nsapi Linked Netscape Server Application Programming Interface uint8 3

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

nsapi Netscape Server Application Programming Interface uint8 3

profile Profile Name string 64

rai string 32

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-gsn User Plane GSN ip 39

uli string 32

vd Virtual Domain Name string 32

version Version uint32 64

41219 - LOGID_GTP_STATE_INVALID

Message ID: 41219

Message Description: LOGID_GTP_STATE_INVALID

FortiOS 6.0.10 Log Reference 898

Fortinet, Inc.
Log Messages

Message Meaning: GTP state invalid

Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-gsn Control Plane GSN ip 39

date Date string 10

dstport Destination Port uint16 5

dtlexp Detailed Explanation string 64

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

linked-nsapi Linked Netscape Server Application Programming Interface uint8 3

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

nsapi Netscape Server Application Programming Interface uint8 3

profile Profile Name string 64

rai string 32

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 899

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-gsn User Plane GSN ip 39

uli string 32

vd Virtual Domain Name string 32

version Version uint32 64

41220 - LOGID_GTP_TUNNEL_LIMIT

Message ID: 41220

Message Description: LOGID_GTP_TUNNEL_LIMIT
Message Meaning: Tunnel limit GTP message. These messages occur only when the maximum number of GTP
tunnels is reached. No new tunnels are created when the maximum number is reached
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-gsn Control Plane GSN ip 39

date Date string 10

dstport Destination Port uint16 5

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

linked-nsapi Linked Netscape Server Application Programming Interface uint8 3

logid Log ID string 10

msg-type Message Type uint8 3

FortiOS 6.0.10 Log Reference 900

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

nsapi Netscape Server Application Programming Interface uint8 3

profile Profile Name string 64

rai string 32

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-gsn User Plane GSN ip 39

uli string 32

vd Virtual Domain Name string 32

version Version uint32 64

41221 - LOGID_GTP_TRAFFIC_COUNT

Message ID: 41221

Message Description: LOGID_GTP_TRAFFIC_COUNT
Message Meaning: Statistic summary information when the GTP tunnel is being torn down
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-bytes Control Plane Data Bytes uint64 20

c-ggsn Control Plane GGSN IP Address ip 39

FortiOS 6.0.10 Log Reference 901

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

c-ggsn-teid Control Plane GGSN Tunnel Endpoint Identifier uint32 10

c-pkts Control Plane Packets uint64 20

c-sgsn Control Plane SGSN IP Address ip 39

c-sgsn-teid Control Plane SGSN Tunnel Endpoint Identifier uint32 10

date Date string 10

duration tunnel duration uint32 10

end-usr-address End user IP Address ip 39

eventtime uint64 20

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

linked-nsapi Linked Netscape Server Application Programming Interface uint8 3

logid Log ID string 10

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

nsapi Netscape Server Application Programming Interface uint8 3

profile Profile Name string 64

rai string 32

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

status Status string 23

subtype Log Subtype string 20

time Time string 8

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-bytes User Plane Data Bytes uint64 20

u-ggsn user plane ggsn IP address ip 39

u-ggsn-teid user plane ggsn teid uint32 10

u-pkts User Plane Packets uint64 20

u-sgsn user plane sgsn IP address ip 39

u-sgsn-teid user plane sgsn tunnel endpoint identifier uint32 10

FortiOS 6.0.10 Log Reference 902

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

uli string 32

vd Virtual Domain Name string 32

version Version uint32 64

41222 - LOGID_GTP_USER_DATA

Message ID: 41222

Message Description: LOGID_GTP_USER_DATA
Message Meaning: GTP user data
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

date Date string 10

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

profile Profile Name string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

user_data user traffic content inside gtp-u tunnel string 256

vd Virtual Domain Name string 32

version Version uint32 64

FortiOS 6.0.10 Log Reference 903

Fortinet, Inc.
Log Messages

41223 - LOGID_GTPV2_FORWARD

Message ID: 41223

Message Description: LOGID_GTPV2_FORWARD
Message Meaning: GTPv2 forward message
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

cpaddr Control Plane Address (either downlink or uplink) ip 39

cpteid Control Plane teid (either downlink or uplink) uint32 10

date Date string 10

dstport Destination Port uint16 5

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

snetwork Source Network, it's a IE type in GTPv2 packet string 64

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 904

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

version Version uint32 64

41224 - LOGID_GTPV2_DENY

Message ID: 41224

Message Description: LOGID_GTPV2_DENY
Message Meaning: GTPv2 deny message
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

cpaddr Control Plane Address (either downlink or uplink) ip 39

cpteid Control Plane teid (either downlink or uplink) uint32 10

date Date string 10

deny_cause Deny Cause string 25

dstport Destination Port uint16 5

dtlexp Detailed Explanation string 64

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

ietype Malformed GTP IE number uint8 3

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

FortiOS 6.0.10 Log Reference 905

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

snetwork Source Network, it's a IE type in GTPv2 packet string 64

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

version Version uint32 64

41225 - LOGID_GTPV2_RATE_LIMIT

Message ID: 41225

Message Description: LOGID_GTPV2_RATE_LIMIT
Message Meaning: GTPv2 rate limit message
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

cpaddr Control Plane Address (either downlink or uplink) ip 39

cpteid Control Plane teid (either downlink or uplink) uint32 10

date Date string 10

FortiOS 6.0.10 Log Reference 906

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

snetwork Source Network, it's a IE type in GTPv2 packet string 64

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

version Version uint32 64

41226 - LOGID_GTPV2_STATE_INVALID

Message ID: 41226

Message Description: LOGID_GTPV2_STATE_INVALID
Message Meaning: GTPv2 state invalid message
Type: GTP

FortiOS 6.0.10 Log Reference 907

Fortinet, Inc.
Log Messages

Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

cpaddr Control Plane Address (either downlink or uplink) ip 39

cpteid Control Plane teid (either downlink or uplink) uint32 10

date Date string 10

dstport Destination Port uint16 5

dtlexp Detailed Explanation string 64

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

snetwork Source Network, it's a IE type in GTPv2 packet string 64

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

FortiOS 6.0.10 Log Reference 908

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

version Version uint32 64

41227 - LOGID_GTPV2_TUNNEL_LIMIT

Message ID: 41227

Message Description: LOGID_GTPV2_TUNNEL_LIMIT
Message Meaning: Tunnel limit GTP (version 2) message
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

cpaddr Control Plane Address (either downlink or uplink) ip 39

cpteid Control Plane teid (either downlink or uplink) uint32 10

date Date string 10

dstport Destination Port uint16 5

end-usr-address End user IP Address ip 39

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

seqnum GTP packet sequence number uint32 10

snetwork Source Network, it's a IE type in GTPv2 packet string 64

FortiOS 6.0.10 Log Reference 909

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

version Version uint32 64

41228 - LOGID_GTPV2_TRAFFIC_COUNT

Message ID: 41228

Message Description: LOGID_GTPV2_TRAFFIC_COUNT
Message Meaning: Statistic summary information when the GTPv2 tunnel is being torn down
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

c-bytes Control Plane Data Bytes uint64 20

c-pkts Control Plane Packets uint64 20

cpdladdr Control Plane Downlink IP Address ip 39

cpdlisraddr Control Plane ISR Downlink IP Address ip 39

cpdlisrteid control plane ISR downlink tunnel endpoint identifier uint32 10

cpdlteid control plane downlink tunnel endpoint identifier uint32 10

cpuladdr control plane uplink IP address ip 39

cpulteid control plane uplink teid uint32 10

date Date string 10

duration tunnel duration uint32 10

end-usr-address End user IP Address ip 39

FortiOS 6.0.10 Log Reference 910

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

imei-sv string 32

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

rat-type Radio Access Technology type string 7

selection APN selection, which is one IE in gtp packet string 14

snetwork Source Network, it's a IE type in GTPv2 packet string 64

status Status string 23

subtype Log Subtype string 20

time Time string 8

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

u-bytes User Plane Data Bytes uint64 20

u-pkts User Plane Packets uint64 20

vd Virtual Domain Name string 32

version Version uint32 64

41229 - LOGID_GTPU_FORWARD

Message ID: 41229

Message Description: LOGID_GTPU_FORWARD
Message Meaning: GTPU forward message
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

date Date string 10

FortiOS 6.0.10 Log Reference 911

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

version Version uint32 64

41230 - LOGID_GTPU_DENY

Message ID: 41230

Message Description: LOGID_GTPU_DENY
Message Meaning: GTPU deny message
Type: GTP
Category: GTP-ALL
Severity: Information

Log Field Name Description Data Type Length

apn Access Point Name string 128

date Date string 10

FortiOS 6.0.10 Log Reference 912

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

deny_cause Deny Cause string 25

dstport Destination Port uint16 5

eventtime uint64 20

from From ip 128

headerteid Tunnel Endpoint ID Header uint32 10

imsi International mobile subscriber ID string 16

level Log Level string 11

logid Log ID string 10

msg-type Message Type uint8 3

msisdn Mobile Subscriber Integrated Services Digital Network-Number string 16

(telephone # to a SIM card)

profile Profile Name string 64

srcport Source Port uint16 5

status Status string 23

subtype Log Subtype string 20

time Time string 8

to To ip 512

tunnel-idx tunnel serial number, internally assigned uint32 10

type Log Type string 16

vd Virtual Domain Name string 32

version Version uint32 64

IPS

16384 - LOGID_ATTCK_SIGNATURE_TCP_UDP

Message ID: 16384

Message Description: LOGID_ATTCK_SIGNATURE_TCP_UDP
Message Meaning: Attack detected by UCP/TCP signature
Type: IPS
Category: SIGNATURE
Severity: Alert

FortiOS 6.0.10 Log Reference 913

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by IPS string 16

attack Attack Name string 256

attackcontext the trigger patterns and the packetdata with base64 encoding string 2040

attackcontextid attack context id / total string 10

attackid Attack ID uint32 10

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype IPS Event Type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

incidentserialno Incident serial number uint32 10

level Log Level string 11

logid Log ID string 10

msg Log message for the attack string 518

policyid Policy ID uint32 10

profile Profile name for IPS string 64

proto Protocol number uint8 3

rawdata string 20480

rawdataid string 10

ref URL of the FortiGuard IPS database entry for the attack. string

service Service name string 36

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 914

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

severity Severity of the attack string 8

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

16385 - LOGID_ATTCK_SIGNATURE_ICMP

Message ID: 16385

Message Description: LOGID_ATTCK_SIGNATURE_ICMP
Message Meaning: Attack detected by ICMP signature
Type: IPS
Category: SIGNATURE
Severity: Alert

Log Field Name Description Data Type Length

action Security action performed by IPS string 16

attack Attack Name string 256

attackcontext the trigger patterns and the packetdata with base64 encoding string 2040

attackcontextid attack context id / total string 10

attackid Attack ID uint32 10

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

FortiOS 6.0.10 Log Reference 915

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

direction string 8

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

eventtime uint64 20

eventtype IPS Event Type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

icmpcode Destination Port of the ICMP message string 6

icmpid Source port of the ICMP message string 8

icmptype The type of ICMP message string 6

incidentserialno Incident serial number uint32 10

level Log Level string 11

logid Log ID string 10

msg Log message for the attack string 518

policyid Policy ID uint32 10

profile Profile name for IPS string 64

proto Protocol number uint8 3

rawdata string 20480

rawdataid string 10

ref URL of the FortiGuard IPS database entry for the attack. string

service Service name string 36

sessionid Session ID uint32 10

severity Severity of the attack string 8

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

subtype Log Subtype string 20

FortiOS 6.0.10 Log Reference 916

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

16386 - LOGID_ATTCK_SIGNATURE_OTHERS

Message ID: 16386

Message Description: LOGID_ATTCK_SIGNATURE_OTHERS
Message Meaning: Attack detected by other signature
Type: IPS
Category: SIGNATURE
Severity: Alert

Log Field Name Description Data Type Length

action Security action performed by IPS string 16

attack Attack Name string 256

attackcontext the trigger patterns and the packetdata with base64 encoding string 2040

attackcontextid attack context id / total string 10

attackid Attack ID uint32 10

crlevel Client Reputation Level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 64

dstintfrole string 10

dstip Destination IP ip 39

eventtime uint64 20

eventtype IPS Event Type string 32

FortiOS 6.0.10 Log Reference 917

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

group User group name string 64

incidentserialno Incident serial number uint32 10

level Log Level string 11

logid Log ID string 10

msg Log message for the attack string 518

policyid Policy ID uint32 10

profile Profile name for IPS string 64

proto Protocol number uint8 3

rawdata string 20480

rawdataid string 10

ref URL of the FortiGuard IPS database entry for the attack. string

service Service name string 36

sessionid Session ID uint32 10

severity Severity of the attack string 8

srcintf Source Interface string 64

srcintfrole string 10

srcip Source IP ip 39

subtype Log Subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

16399 - LOGID_ATTACK_MALICIOUS_URL

Message ID: 16399

Message Description: LOGID_ATTACK_MALICIOUS_URL
Message Meaning: Attack detected by a malicious URL

FortiOS 6.0.10 Log Reference 918

Fortinet, Inc.
Log Messages

Type: IPS
Category: MALICIOUS-URL
Severity: Alert

Log Field Name Description Data Type Length

action string 16

attack string 256

attackcontext string 2040

attackcontextid string 10

attackid uint32 10

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 64

dstintfrole string 10

dstip ip 39

eventtime uint64 20

eventtype string 32

forwardedfor string 128

group string 64

hostname string 256

incidentserialno uint32 10

level string 11

logid string 10

msg string 518

policyid uint32 10

profile string 64

proto uint8 3

rawdata string 20480

rawdataid string 10

ref string

service string 36

FortiOS 6.0.10 Log Reference 919

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sessionid uint32 10

severity string 8

srcintf string 64

srcintfrole string 10

srcip ip 39

subtype string 20

time string 8

trueclntip ip 39

type string 16

url string 512

user string 256

vd string 32

vrf uint8 3

SSH

61000 - LOG_ID_SSH_COMMAND_BLOCK

Message ID: 61000

Message Description: LOG_ID_SSH_COMMAND_BLOCK
Message Meaning: Depends on info in msg field
Type: SSH
Category: SSH-COMMAND
Severity: Warning

Log Field Name Description Data Type Length

action string 17

command string 256

date string 10

direction string

dstintf string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 920

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip ip 39

dstport uint16 5

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

login string 128

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

severity string 8

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

61001 - LOG_ID_SSH_COMMAND_BLOCK_ALERT

Message ID: 61001

Message Description: LOG_ID_SSH_COMMAND_BLOCK_ALERT
Message Meaning: Depends on info in msg field
Type: SSH
Category: SSH-COMMAND
Severity: Alert

FortiOS 6.0.10 Log Reference 921

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 17

command string 256

date string 10

direction string

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

login string 128

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

severity string 8

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

FortiOS 6.0.10 Log Reference 922

Fortinet, Inc.
Log Messages

61002 - LOG_ID_SSH_COMMAND_PASS

Message ID: 61002

Message Description: LOG_ID_SSH_COMMAND_PASS
Message Meaning: Depends on info in msg field
Type: SSH
Category: SSH-COMMAND
Severity: Notice

Log Field Name Description Data Type Length

action string 17

command string 256

date string 10

direction string

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

login string 128

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

severity string 8

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

FortiOS 6.0.10 Log Reference 923

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

61003 - LOG_ID_SSH_COMMAND_PASS_ALERT

Message ID: 61003

Message Description: LOG_ID_SSH_COMMAND_PASS_ALERT
Message Meaning: Depends on info in msg field
Type: SSH
Category: SSH-COMMAND
Severity: Alert

Log Field Name Description Data Type Length

action string 17

command string 256

date string 10

direction string

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

login string 128

FortiOS 6.0.10 Log Reference 924

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

severity string 8

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

61010 - LOG_ID_SSH_CHANNEL_BLOCK

Message ID: 61010

Message Description: LOG_ID_SSH_CHANNEL_BLOCK
Message Meaning: Depends on info in msg field
Type: SSH
Category: SSH-CHANNEL
Severity: Warning

Log Field Name Description Data Type Length

action string 17

channeltype string 15

date string 10

direction string

dstintf string 32

FortiOS 6.0.10 Log Reference 925

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

login string 128

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

61011 - LOG_ID_SSH_CHANNEL_PASS

Message ID: 61011

Message Description: LOG_ID_SSH_CHANNEL_PASS
Message Meaning: Depends on info in msg field
Type: SSH
Category: SSH-CHANNEL
Severity: Notice

FortiOS 6.0.10 Log Reference 926

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 17

channeltype string 15

date string 10

direction string

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtype string 32

fctuid string 32

group string 64

level string 11

logid string 10

login string 128

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

type string 16

unauthuser string 66

unauthusersource string 66

user string 256

vd string 32

FortiOS 6.0.10 Log Reference 927

Fortinet, Inc.
Log Messages

Traffic

2 - LOG_ID_TRAFFIC_ALLOW

Message ID: 2
Message Description: LOG_ID_TRAFFIC_ALLOW
Message Meaning: Allowed traffic
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 928

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

FortiOS 6.0.10 Log Reference 929

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

FortiOS 6.0.10 Log Reference 930

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwpvlanid uint32 10

3 - LOG_ID_TRAFFIC_DENY

Message ID: 3
Message Description: LOG_ID_TRAFFIC_DENY
Message Meaning: Traffic violation
Type: Traffic
Category: FORWARD
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

FortiOS 6.0.10 Log Reference 931

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

FortiOS 6.0.10 Log Reference 932

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

FortiOS 6.0.10 Log Reference 933

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwpvlanid uint32 10

4 - LOG_ID_TRAFFIC_OTHER_START

Message ID: 4
Message Description: LOG_ID_TRAFFIC_OTHER_START
Message Meaning: Traffic other session start
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

FortiOS 6.0.10 Log Reference 934

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

FortiOS 6.0.10 Log Reference 935

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

FortiOS 6.0.10 Log Reference 936

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwpvlanid uint32 10

5 - LOG_ID_TRAFFIC_OTHER_ICMP_ALLOW

Message ID: 5
Message Description: LOG_ID_TRAFFIC_OTHER_ICMP_ALLOW
Message Meaning: Traffic allowed ICMP
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

FortiOS 6.0.10 Log Reference 937

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

FortiOS 6.0.10 Log Reference 938

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvdpkt Received Packets uint32 10

sentbyte Sent Bytes uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

FortiOS 6.0.10 Log Reference 939

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwpvlanid uint32 10

6 - LOG_ID_TRAFFIC_OTHER_ICMP_DENY

Message ID: 6
Message Description: LOG_ID_TRAFFIC_OTHER_ICMP_DENY
Message Meaning: Traffic denied ICMP
Type: Traffic
Category: FORWARD
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

FortiOS 6.0.10 Log Reference 940

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

FortiOS 6.0.10 Log Reference 941

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

FortiOS 6.0.10 Log Reference 942

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwpvlanid uint32 10

7 - LOG_ID_TRAFFIC_OTHER_INVALID

Message ID: 7
Message Description: LOG_ID_TRAFFIC_OTHER_INVALID
Message Meaning: Traffic other invalid
Type: Traffic
Category: FORWARD
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

FortiOS 6.0.10 Log Reference 943

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

centralnatid Central NAT ID uint32 10

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 944

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

FortiOS 6.0.10 Log Reference 945

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

8 - LOG_ID_TRAFFIC_WANOPT

Message ID: 8
Message Description: LOG_ID_TRAFFIC_WANOPT
Message Meaning: WAN optimization traffic
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

FortiOS 6.0.10 Log Reference 946

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

comment string 1024

countapp Number of App Ctrl logs associated with the session uint32 10

countav Number of AV logs associated with the session uint32 10

countdlp Number of the DLP logs associated with the session uint32 10

countssh uint32 10

countwaf uint32 10

countweb Number of the Web Filter logs associated with the session uint32 10

craction Action performed by Client Reputation uint32 10

crscore Client Reputation score uint32 10

date Date string 10

devid Device serial number string 16

dstcountry Country name for the destination IP string 64

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstname The destination name. string 66

dstport Destination Port uint16 5

dstssid Destination SSID string 33

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

lanin LAN incoming traffic in bytes uint64 20

lanout LAN outgoing traffic in bytes uint64 20

level Log Level string 11

logid Log ID string 10

msg Log message string 64

FortiOS 6.0.10 Log Reference 947

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

srccountry Country name for Source IP string 64

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcname Source name string 66

srcport Source port number uint16 5

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

sslaction string 26

subtype Subtype of the traffic string 20

time Time string 8

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

utmaction Security action performed by UTM string 32

vd Virtual domain name string 32

FortiOS 6.0.10 Log Reference 948

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vrf uint8 3

vwpvlanid uint32 10

wanin WAN incoming traffic in bytes uint64 20

wanoptapptype WAN Optimization Application type string 9

wanout WAN outgoing traffic in bytes uint64 20

9 - LOG_ID_TRAFFIC_WEBCACHE

Message ID: 9
Message Description: LOG_ID_TRAFFIC_WEBCACHE
Message Meaning: Web cache traffic
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

comment string 1024

countwaf uint32 10

craction Action performed by Client Reputation uint32 10

crscore Client Reputation score uint32 10

date Date string 10

devid Device serial number string 16

dstcountry Country name for the destination IP string 64

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

FortiOS 6.0.10 Log Reference 949

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstname The destination name. string 66

dstport Destination Port uint16 5

dstssid Destination SSID string 33

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

lanin LAN incoming traffic in bytes uint64 20

lanout LAN outgoing traffic in bytes uint64 20

level Log Level string 11

logid Log ID string 10

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

srccountry Country name for Source IP string 64

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcname Source name string 66

srcport Source port number uint16 5

FortiOS 6.0.10 Log Reference 950

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

sslaction string 26

subtype Subtype of the traffic string 20

time Time string 8

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

utmaction Security action performed by UTM string 32

vd Virtual domain name string 32

vrf uint8 3

vwpvlanid uint32 10

wanin WAN incoming traffic in bytes uint64 20

wanoptapptype WAN Optimization Application type string 9

wanout WAN outgoing traffic in bytes uint64 20

10 - LOG_ID_TRAFFIC_EXPLICIT_PROXY

Message ID: 10
Message Description: LOG_ID_TRAFFIC_EXPLICIT_PROXY
Message Meaning: Explicit proxy traffic
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

FortiOS 6.0.10 Log Reference 951

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

comment string 1024

countssh uint32 10

countwaf uint32 10

craction Action performed by Client Reputation uint32 10

crscore Client Reputation score uint32 10

date Date string 10

devid Device serial number string 16

dstcountry Country name for the destination IP string 64

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstname The destination name. string 66

dstport Destination Port uint16 5

dstssid Destination SSID string 33

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

lanin LAN incoming traffic in bytes uint64 20

lanout LAN outgoing traffic in bytes uint64 20

level Log Level string 11

logid Log ID string 10

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

FortiOS 6.0.10 Log Reference 952

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

srccountry Country name for Source IP string 64

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcname Source name string 66

srcport Source port number uint16 5

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

sslaction string 26

subtype Subtype of the traffic string 20

time Time string 8

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

utmaction Security action performed by UTM string 32

vd Virtual domain name string 32

vrf uint8 3

vwpvlanid uint32 10

wanin WAN incoming traffic in bytes uint64 20

FortiOS 6.0.10 Log Reference 953

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

wanoptapptype WAN Optimization Application type string 9

wanout WAN outgoing traffic in bytes uint64 20

11 - LOG_ID_TRAFFIC_FAIL_CONN

Message ID: 11
Message Description: LOG_ID_TRAFFIC_FAIL_CONN
Message Meaning: Failed connection attempts
Type: Traffic
Category: FORWARD
Severity: Warning

Log Field Name Description Data Type Length

centralnatid Central NAT ID uint32 10

comment string 1024

date Date string 10

devid Device serial number string 16

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstname The destination name. string 66

dstport Destination Port uint16 5

dstssid Destination SSID string 33

dstuuid UUID of the Destination IP address string 37

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

FortiOS 6.0.10 Log Reference 954

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

poluuid UUID of the Firewall Policy string 37

sessionid Session ID uint32 10

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcname Source name string 66

srcport Source port number uint16 5

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12 - LOG_ID_TRAFFIC_MULTICAST

Message ID: 12
Message Description: LOG_ID_TRAFFIC_MULTICAST
Message Meaning: Multicast traffic
Type: Traffic
Category: MULTICAST
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

FortiOS 6.0.10 Log Reference 955

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

FortiOS 6.0.10 Log Reference 956

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvdpkt Received Packets uint32 10

sentbyte Sent Bytes uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

FortiOS 6.0.10 Log Reference 957

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

13 - LOG_ID_TRAFFIC_END_FORWARD

Message ID: 13
Message Description: LOG_ID_TRAFFIC_END_FORWARD
Message Meaning: Forward traffic
Type: Traffic
Category: FORWARD
Severity: Notice

FortiOS 6.0.10 Log Reference 958

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent string 64

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

apsn string 36

centralnatid Central NAT ID uint32 10

collectedemail string 66

comment string 1024

countapp Number of App Ctrl logs associated with the session uint32 10

countav Number of AV logs associated with the session uint32 10

countdlp Number of the DLP logs associated with the session uint32 10

countemail Number of the email logs associated with the session uint32 10

countips Number of the IPS logs associated with the session uint32 10

countssh uint32 10

countweb Number of the Web Filter logs associated with the session uint32 10

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 959

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policymode string 8

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvdpkt Received Packets uint32 10

FortiOS 6.0.10 Log Reference 960

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sentbyte Sent Bytes uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

shapingpolicyid uint32 10

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

sslaction string 26

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

FortiOS 6.0.10 Log Reference 961

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

url string 512

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwlid uint32 10

vwlquality string 320

vwlservice string 64

vwpvlanid uint32 10

14 - LOG_ID_TRAFFIC_END_LOCAL

Message ID: 14
Message Description: LOG_ID_TRAFFIC_END_LOCAL
Message Meaning: Local traffic
Type: Traffic
Category: LOCAL
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

FortiOS 6.0.10 Log Reference 962

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

FortiOS 6.0.10 Log Reference 963

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvdpkt Received Packets uint32 10

sentbyte Sent Bytes uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

FortiOS 6.0.10 Log Reference 964

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

15 - LOG_ID_TRAFFIC_START_FORWARD

Message ID: 15
Message Description: LOG_ID_TRAFFIC_START_FORWARD
Message Meaning: Forward traffic session start
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

FortiOS 6.0.10 Log Reference 965

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

apsn string 36

centralnatid Central NAT ID uint32 10

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

FortiOS 6.0.10 Log Reference 966

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

shapingpolicyid uint32 10

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

FortiOS 6.0.10 Log Reference 967

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwpvlanid uint32 10

16 - LOG_ID_TRAFFIC_START_LOCAL

Message ID: 16
Message Description: LOG_ID_TRAFFIC_START_LOCAL
Message Meaning: Local traffic session start
Type: Traffic
Category: LOCAL
Severity: Notice

FortiOS 6.0.10 Log Reference 968

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

centralnatid Central NAT ID uint32 10

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

FortiOS 6.0.10 Log Reference 969

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

sentbyte Sent Bytes uint64 20

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

FortiOS 6.0.10 Log Reference 970

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

17 - LOG_ID_TRAFFIC_SNIFFER

Message ID: 17
Message Description: LOG_ID_TRAFFIC_SNIFFER
Message Meaning: Sniffer traffic
Type: Traffic
Category: SNIFFER
Severity: Notice

FortiOS 6.0.10 Log Reference 971

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 16

app string 96

appact string 16

appcat string 64

appid uint32 10

applist string 64

apprisk string 16

collectedemail string 66

comment string 1024

countapp uint32 10

countav uint32 10

countdlp uint32 10

countemail uint32 10

countips uint32 10

countweb uint32 10

date string 10

devcategory string 32

devid string 16

devtype string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf string 32

dstintfrole string 10

dstip ip 39

dstmac string 17

dstname string 66

dstosname string 66

dstosversion string 66

dstport uint16 5

FortiOS 6.0.10 Log Reference 972

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstserver uint32 10

dstssid string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid string 37

duration uint32 10

eventtime uint64 20

fctuid string 32

group string 64

level string 11

logid string 10

masterdstmac string 17

mastersrcmac string 17

msg string 64

osname string 66

osversion string 66

policyid uint32 10

policyname string 36

policytype string 24

poluuid string 37

proto uint8 3

rcvdbyte uint64 20

rcvdpkt uint32 10

sentbyte uint64 20

sentpkt uint32 10

service string 63

sessionid uint32 10

shaperdroprcvdbyte uint32 10

shaperdropsentbyte uint32 10

shaperperipdropbyte uint32 10

FortiOS 6.0.10 Log Reference 973

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

shaperperipname string 36

shaperrcvdname string 36

shapersentname string 36

srcintf string 32

srcintfrole string 10

srcip ip 39

srcmac string 17

srcname string 66

srcport uint16 5

srcserver uint32 10

srcssid string 33

srcuuid string 37

subtype string 20

time string 8

trandisp string 16

tranip ip 39

tranport uint16 5

transip ip 39

transport uint16 5

type string 16

unauthuser string 66

unauthuser string 66

unauthusersource string 66

unauthusersource string 66

user string 256

vd string 32

vpn string 32

vpntype string 14

vrf uint8 3

FortiOS 6.0.10 Log Reference 974

Fortinet, Inc.
Log Messages

19 - LOG_ID_TRAFFIC_BROADCAST

Message ID: 19
Message Description: LOG_ID_TRAFFIC_BROADCAST
Message Meaning: Broadcast traffic
Type: Traffic
Category: MULTICAST
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

FortiOS 6.0.10 Log Reference 975

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvdpkt Received Packets uint32 10

sentbyte Sent Bytes uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 976

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

FortiOS 6.0.10 Log Reference 977

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vpntype The type of the VPN tunnel string 14

vrf uint8 3

20 - LOG_ID_TRAFFIC_STAT

Message ID: 20
Message Description: LOG_ID_TRAFFIC_STAT
Message Meaning: Forward traffic statistics
Type: Traffic
Category: FORWARD
Severity: Notice

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent string 64

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

apsn string 36

centralnatid Central NAT ID uint32 10

collectedemail string 66

comment string 1024

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

FortiOS 6.0.10 Log Reference 978

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policymode string 8

policyname string 36

policytype string 24

FortiOS 6.0.10 Log Reference 979

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvddelta uint64 20

rcvdpkt Received Packets uint32 10

sentbyte Sent Bytes uint64 20

sentdelta uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

shapingpolicyid uint32 10

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

sslaction string 26

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

FortiOS 6.0.10 Log Reference 980

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

url string 512

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwlid uint32 10

vwlquality string 320

vwlservice string 64

vwpvlanid uint32 10

21 - LOG_ID_TRAFFIC_SNIFFER_STAT

Message ID: 21
Message Description: LOG_ID_TRAFFIC_SNIFFER_STAT
Message Meaning: Sniffer traffic statistics
Type: Traffic
Category: SNIFFER
Severity: Notice

Log Field Name Description Data Type Length

action string 16

app string 96

FortiOS 6.0.10 Log Reference 981

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

appact string 16

appcat string 64

appid uint32 10

applist string 64

apprisk string 16

collectedemail string 66

comment string 1024

date string 10

devcategory string 32

devid string 16

devtype string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf string 32

dstintfrole string 10

dstip ip 39

dstmac string 17

dstname string 66

dstosname string 66

dstosversion string 66

dstport uint16 5

dstserver uint32 10

dstssid string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid string 37

duration uint32 10

eventtime uint64 20

fctuid string 32

FortiOS 6.0.10 Log Reference 982

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group string 64

level string 11

logid string 10

masterdstmac string 17

mastersrcmac string 17

msg string 64

osname string 66

osversion string 66

policyid uint32 10

policyname string 36

policytype string 24

poluuid string 37

proto uint8 3

rcvdbyte uint64 20

rcvddelta uint64 20

rcvdpkt uint32 10

sentbyte uint64 20

sentdelta uint64 20

sentpkt uint32 10

service string 63

sessionid uint32 10

shaperdroprcvdbyte uint32 10

shaperdropsentbyte uint32 10

shaperperipdropbyte uint32 10

shaperperipname string 36

shaperrcvdname string 36

shapersentname string 36

srcintf string 32

srcintfrole string 10

srcip ip 39

FortiOS 6.0.10 Log Reference 983

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcmac string 17

srcname string 66

srcport uint16 5

srcserver uint32 10

srcssid string 33

srcuuid string 37

subtype string 20

time string 8

trandisp string 16

tranip ip 39

tranport uint16 5

transip ip 39

transport uint16 5

type string 16

unauthuser string 66

unauthuser string 66

unauthusersource string 66

unauthusersource string 66

user string 256

vd string 32

vpn string 32

vpntype string 14

vrf uint8 3

22 - LOG_ID_TRAFFIC_UTM_CORRELATION

Message ID: 22
Message Description: LOG_ID_TRAFFIC_UTM_CORRELATION
Message Meaning: Forward traffic for UTM correlation
Type: Traffic
Category: FORWARD
Severity: Notice

FortiOS 6.0.10 Log Reference 984

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 16

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent string 64

app Application name string 96

appact The security action from app control string 16

appcat Application category string 64

appid Application ID uint32 10

applist Application Control profile (name) string 64

apprisk Application Risk Level string 16

apsn string 36

centralnatid Central NAT ID uint32 10

collectedemail string 66

comment string 1024

countapp Number of App Ctrl logs associated with the session uint32 10

countav Number of AV logs associated with the session uint32 10

countdlp Number of the DLP logs associated with the session uint32 10

countemail Number of the email logs associated with the session uint32 10

countips Number of the IPS logs associated with the session uint32 10

countssh uint32 10

countweb Number of the Web Filter logs associated with the session uint32 10

date Date string 10

devcategory string 32

devid Device serial number string 16

devtype Device type string 32

dstcollectedemail string 66

dstdevcategory string 32

dstdevtype string 32

dstintf Destination Interface string 32

dstintfrole string 10

FortiOS 6.0.10 Log Reference 985

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstip Destination IP Address ip 39

dstmac string 17

dstname The destination name. string 66

dstosname string 66

dstosversion string 66

dstport Destination Port uint16 5

dstserver uint32 10

dstssid Destination SSID string 33

dstunauthuser string 66

dstunauthusersource string 66

dstuuid UUID of the Destination IP address string 37

duration Duration of the session uint32 10

eventtime uint64 20

fctuid string 32

group User group name string 64

level Log Level string 11

logid Log ID string 10

masterdstmac string 17

mastersrcmac The master MAC address for a host that has multiple network string 17
interfaces

msg Log message string 64

osname Name of the device's OS string 66

osversion string 66

policyid Firewall Policy ID uint32 10

policymode string 8

policyname string 36

policytype string 24

poluuid UUID of the Firewall Policy string 37

proto protocol number uint8 3

rcvdbyte Received Bytes uint64 20

rcvdpkt Received Packets uint32 10

FortiOS 6.0.10 Log Reference 986

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sentbyte Sent Bytes uint64 20

sentpkt Sent Packets uint32 10

service Name of service string 63

sessionid Session ID uint32 10

shaperdroprcvdbyte Received bytes dropped by shaper uint32 10

shaperdropsentbyte Sent bytes dropped by shaper uint32 10

shaperperipdropbyte Dropped bytes per IP by shaper uint32 10

shaperperipname Traffic shaper name (per IP) string 36

shaperrcvdname Traffic shaper name for received traffic string 36

shapersentname Traffic shaper name for sent traffic string 36

shapingpolicyid uint32 10

srcintf Source interface name string 32

srcintfrole string 10

srcip Source IP address ip 39

srcmac MAC address associated with the Source IP string 17

srcname Source name string 66

srcport Source port number uint16 5

srcserver uint32 10

srcssid Source SSID string 33

srcuuid UUID of the Source IP Address string 37

sslaction string 26

subtype Subtype of the traffic string 20

time Time string 8

trandisp NAT translation type string 16

tranip NAT destination IP ip 39

tranport NAT Destination Port uint16 5

transip NAT Source IP ip 39

transport NAT Source Port uint16 5

type Log type string 16

unauthuser Unauthenticated user name string 66

FortiOS 6.0.10 Log Reference 987

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser Unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

unauthusersource The method used to detect unauthenticated user name string 66

url string 512

user User name string 256

vd Virtual domain name string 32

vpn The name of the VPN tunnel string 32

vpntype The type of the VPN tunnel string 14

vrf uint8 3

vwlid uint32 10

vwlquality string 320

vwlservice string 64

vwpvlanid uint32 10

VoIP

44032 - LOGID_EVENT_VOIP_SIP

Message ID: 44032

Message Description: LOGID_EVENT_VOIP_SIP
Message Meaning: VoIP SIP
Type: VoIP
Category: VOIP
Severity: Information

Log Field Name Description Data Type Length

action string 15

call_id string 64

date string 10

devid string 16

dir string 16

dstip ip 39

FortiOS 6.0.10 Log Reference 988

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dst_int string 16

dst_port uint16 5

duration uint32 10

epoch uint32 10

eventtime uint64 20

event_id uint32 10

from string 128

kind string 10

level string 11

logid string 10

policy_id uint32 10

profile string 64

proto uint8 3

session_id uint32 10

srcip ip 39

src_int string 16

src_port uint16 5

status string 23

subtype string 20

time string 8

to string 512

type string 16

vd string 32

voip_proto string 4

44033 - LOGID_EVENT_VOIP_SIP_BLOCK

Message ID: 44033

Message Description: LOGID_EVENT_VOIP_SIP_BLOCK
Message Meaning: VoIP SIP blocked
Type: VoIP
Category: VOIP
Severity: Notice

FortiOS 6.0.10 Log Reference 989

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 15

call_id string 64

count uint32 10

date string 10

devid string 16

dir string 16

dstip ip 39

dst_int string 16

dst_port uint16 5

duration uint32 10

epoch uint32 10

eventtime uint64 20

event_id uint32 10

from string 128

kind string 10

level string 11

logid string 10

message_type string 16

policy_id uint32 10

profile string 64

proto uint8 3

reason string 128

request_name string 64

session_id uint32 10

srcip ip 39

src_int string 16

src_port uint16 5

status string 23

subtype string 20

time string 8

FortiOS 6.0.10 Log Reference 990

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

to string 512

type string 16

vd string 32

voip_proto string 4

44034 - LOGID_EVENT_VOIP_SIP_FUZZING

Message ID: 44034

Message Description: LOGID_EVENT_VOIP_SIP_FUZZING
Message Meaning: VoIP SIP fuzzing
Type: VoIP
Category: VOIP
Severity: Information

Log Field Name Description Data Type Length

action string 15

call_id string 64

column uint32 10

date string 10

devid string 16

dir string 16

dstip ip 39

dst_int string 16

dst_port uint16 5

duration uint32 10

epoch uint32 10

eventtime uint64 20

event_id uint32 10

kind string 10

level string 11

line string 128

logid string 10

FortiOS 6.0.10 Log Reference 991

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

malform_data uint32 10

malform_desc string 47

message_type string 16

policy_id uint32 10

profile string 64

proto uint8 3

request_name string 64

session_id uint32 10

srcip ip 39

src_int string 16

src_port uint16 5

subtype string 20

time string 8

type string 16

vd string 32

voip_proto string 4

44035 - LOGID_EVENT_VOIP_SCCP_REGISTER

Message ID: 44035

Message Description: LOGID_EVENT_VOIP_SCCP_REGISTER
Message Meaning: VoIP SCCP registered
Type: VoIP
Category: VOIP
Severity: Information

Log Field Name Description Data Type Length

action string 15

date string 10

devid string 16

dstip ip 39

dst_port uint16 5

FortiOS 6.0.10 Log Reference 992

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

epoch uint32 10

eventtime uint64 20

event_id uint32 10

kind string 10

level string 11

locip ip 39

logid string 10

phone string 64

policy_id uint32 10

profile string 64

proto uint8 3

session_id uint32 10

srcip ip 39

src_int string 16

src_port uint16 5

status string 23

subtype string 20

time string 8

type string 16

vd string 32

voip_proto string 4

44036 - LOGID_EVENT_VOIP_SCCP_UNREGISTER

Message ID: 44036

Message Description: LOGID_EVENT_VOIP_SCCP_UNREGISTER
Message Meaning: VoIP SCCP unregistered
Type: VoIP
Category: VOIP
Severity: Information

FortiOS 6.0.10 Log Reference 993

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action string 15

date string 10

devid string 16

dstip ip 39

dst_port uint16 5

epoch uint32 10

eventtime uint64 20

event_id uint32 10

kind string 10

level string 11

locip ip 39

logid string 10

phone string 64

policy_id uint32 10

profile string 64

proto uint8 3

reason string 128

session_id uint32 10

srcip ip 39

src_int string 16

src_port uint16 5

status string 23

subtype string 20

time string 8

type string 16

vd string 32

voip_proto string 4

44037 - LOGID_EVENT_VOIP_SCCP_CALL_BLOCK

Message ID: 44037

Message Description: LOGID_EVENT_VOIP_SCCP_CALL_BLOCK

FortiOS 6.0.10 Log Reference 994

Fortinet, Inc.
Log Messages

Message Meaning: VoIP SCCP call blocked

Type: VoIP
Category: VOIP
Severity: Information

Log Field Name Description Data Type Length

action string 15

date string 10

devid string 16

dstip ip 39

dst_port uint16 5

epoch uint32 10

eventtime uint64 20

event_id uint32 10

kind string 10

level string 11

locip ip 39

logid string 10

phone string 64

policy_id uint32 10

profile string 64

proto uint8 3

reason string 128

session_id uint32 10

srcip ip 39

src_int string 16

src_port uint16 5

status string 23

subtype string 20

time string 8

type string 16

vd string 32

voip_proto string 4

FortiOS 6.0.10 Log Reference 995

Fortinet, Inc.
Log Messages

44038 - LOGID_EVENT_VOIP_SCCP_CALL_INFO

Message ID: 44038

Message Description: LOGID_EVENT_VOIP_SCCP_CALL_INFO
Message Meaning: VoIP SCCP call information
Type: VoIP
Category: VOIP
Severity: Information

Log Field Name Description Data Type Length

action string 15

date string 10

devid string 16

dstip ip 39

dst_int string 16

dst_port uint16 5

duration uint32 10

epoch uint32 10

eventtime uint64 20

event_id uint32 10

kind string 10

level string 11

locip ip 39

locport uint16 5

logid string 10

phone string 64

policy_id uint32 10

profile string 64

proto uint8 3

remip ip 39

remport uint16 5

session_id uint32 10

srcip ip 39

FortiOS 6.0.10 Log Reference 996

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

src_int string 16

src_port uint16 5

status string 23

subtype string 20

time string 8

type string 16

vd string 32

voip_proto string 4

WAF

30248 - LOGID_WAF_SIGNATURE_BLOCK

Message ID: 30248

Message Description: LOGID_WAF_SIGNATURE_BLOCK
Message Meaning: Web application firewall blocked application by signature
Type: WAF
Category: WAF-SIGNATURE
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 997

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventid Event ID uint32 10

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30249 - LOGID_WAF_SIGNATURE_PASS

Message ID: 30249

Message Description: LOGID_WAF_SIGNATURE_PASS
Message Meaning: Web application firewall passed application by signature

FortiOS 6.0.10 Log Reference 998

Fortinet, Inc.
Log Messages

Type: WAF
Category: WAF-SIGNATURE
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventid Event ID uint32 10

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

FortiOS 6.0.10 Log Reference 999

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30250 - LOGID_WAF_SIGNATURE_ERASE

Message ID: 30250

Message Description: LOGID_WAF_SIGNATURE_ERASE
Message Meaning: Web application firewall erased application by signature
Type: WAF
Category: WAF-SIGNATURE
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventid Event ID uint32 10

eventtime uint64 20

FortiOS 6.0.10 Log Reference 1000

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

msg Log Message string

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30251 - LOGID_WAF_CUSTOM_SIGNATURE_BLOCK

Message ID: 30251

Message Description: LOGID_WAF_CUSTOM_SIGNATURE_BLOCK
Message Meaning: Web application firewall blocked application by custom signature
Type: WAF
Category: WAF-CUSTOM-SIGNATURE
Severity: Warning

FortiOS 6.0.10 Log Reference 1001

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

name Method or custom signature name string 64

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 1002

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30252 - LOGID_WAF_CUSTOM_SIGNATURE_PASS

Message ID: 30252

Message Description: LOGID_WAF_CUSTOM_SIGNATURE_PASS
Message Meaning: Web application firewall allowed application by custom signature
Type: WAF
Category: WAF-CUSTOM-SIGNATURE
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

FortiOS 6.0.10 Log Reference 1003

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

name Method or custom signature name string 64

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30253 - LOGID_WAF_METHOD_BLOCK

Message ID: 30253

Message Description: LOGID_WAF_METHOD_BLOCK
Message Meaning: Web application firewall blocked application by HTTP method
Type: WAF
Category: WAF-HTTP-METHOD
Severity: Warning

FortiOS 6.0.10 Log Reference 1004

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventid Event ID uint32 10

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

method Http Method string

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

FortiOS 6.0.10 Log Reference 1005

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30255 - LOGID_WAF_ADDRESS_LIST_BLOCK

Message ID: 30255

Message Description: LOGID_WAF_ADDRESS_LIST_BLOCK
Message Meaning: Web application firewall blocked application by address list
Type: WAF
Category: WAF-ADDRESS-LIST
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

FortiOS 6.0.10 Log Reference 1006

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30257 - LOGID_WAF_CONSTRAINTS_BLOCK

Message ID: 30257

Message Description: LOGID_WAF_CONSTRAINTS_BLOCK
Message Meaning: Web application firewall blocked application by HTTP constraints
Type: WAF
Category: WAF-HTTP-CONSTRAINT
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

FortiOS 6.0.10 Log Reference 1007

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

agent Agent string 64

constraint WAF http protocol restrictions string

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

FortiOS 6.0.10 Log Reference 1008

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User Name string 256

vd Virtual Domain Name string 32

30258 - LOGID_WAF_CONSTRAINTS_PASS

Message ID: 30258

Message Description: LOGID_WAF_CONSTRAINTS_PASS
Message Meaning: Web application firewall allowed application by HTTP constraints
Type: WAF
Category: WAF-HTTP-CONSTRAINT
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

constraint WAF http protocol restrictions string

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

FortiOS 6.0.10 Log Reference 1009

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30259 - LOGID_WAF_URL_ACCESS_PERMIT

Message ID: 30259

Message Description: LOGID_WAF_URL_ACCESS_PERMIT
Message Meaning: Web application firewall allowed application by URL access permit
Type: WAF
Category: WAF-URL-ACCESS
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

FortiOS 6.0.10 Log Reference 1010

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventid Event ID uint32 10

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30260 - LOGID_WAF_URL_ACCESS_BYPASS

Message ID: 30260

FortiOS 6.0.10 Log Reference 1011

Fortinet, Inc.
Log Messages

Message Description: LOGID_WAF_URL_ACCESS_BYPASS

Message Meaning: Web application firewall allowed application by URL access bypass
Type: WAF
Category: WAF-URL-ACCESS
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventid Event ID uint32 10

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

FortiOS 6.0.10 Log Reference 1012

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

30261 - LOGID_WAF_URL_ACCESS_BLOCK

Message ID: 30261

Message Description: LOGID_WAF_URL_ACCESS_BLOCK
Message Meaning: Web application firewall blocked application by URL access
Type: WAF
Category: WAF-URL-ACCESS
Severity: Warning

Log Field Name Description Data Type Length

action status of the session. Uses following definition: - Deny = string 17

blocked by firewall policy. - Start = session start log (special
option to enable logging at start of a session). This means
firewall allowed. - All Others = allowed by Firewall Policy and
the status indicates how it was closed.

agent Agent string 64

date Date string 10

direction Direction string

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP Address ip 39

dstport Destination Port uint16 5

eventid Event ID uint32 10

FortiOS 6.0.10 Log Reference 1013

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Event Type string 32

fctuid string 32

group User Group Name string 64

level Log Level string 11

logid Log ID string 10

policyid Policy ID uint32 10

profile Full profile name string 64

proto Protocol uint8 3

service Service name string 5

sessionid Session ID uint32 10

severity Severity string 6

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP Address ip 39

srcport Source Port uint16 5

subtype Log Subtype string 20

time Time string 8

type Log Type string 16

unauthuser string 66

unauthusersource string 66

url URL string 512

user User Name string 256

vd Virtual Domain Name string 32

Web

12288 - LOG_ID_WEB_CONTENT_BANWORD

Message ID: 12288

Message Description: LOG_ID_WEB_CONTENT_BANWORD
Message Meaning: Web content banned word found

FortiOS 6.0.10 Log Reference 1014

Fortinet, Inc.
Log Messages

Type: Web
Category: CONTENT
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

banword Banned word string 128

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

FortiOS 6.0.10 Log Reference 1015

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12289 - LOG_ID_WEB_CONTENT_MMS_BANWORD

Message ID: 12289

Message Description: LOG_ID_WEB_CONTENT_MMS_BANWORD
Message Meaning: Web content MMS banned word found
Type: Web
Category: CONTENT
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

banword Banned word string 128

FortiOS 6.0.10 Log Reference 1016

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

FortiOS 6.0.10 Log Reference 1017

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12290 - LOG_ID_WEB_CONTENT_EXEMPTWORD

Message ID: 12290

Message Description: LOG_ID_WEB_CONTENT_EXEMPTWORD
Message Meaning: Web content exempt word found
Type: Web
Category: CONTENT
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

banword Banned word string 128

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

FortiOS 6.0.10 Log Reference 1018

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 1019

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12291 - LOG_ID_WEB_CONTENT_MMS_EXEMPTWORD

Message ID: 12291

Message Description: LOG_ID_WEB_CONTENT_MMS_EXEMPTWORD
Message Meaning: Web content MMS exempt word found
Type: Web
Category: CONTENT
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

banword Banned word string 128

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

FortiOS 6.0.10 Log Reference 1020

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12292 - LOG_ID_WEB_CONTENT_KEYWORD

Message ID: 12292

Message Description: LOG_ID_WEB_CONTENT_KEYWORD

FortiOS 6.0.10 Log Reference 1021

Fortinet, Inc.
Log Messages

Message Meaning: Message contained a key word in the profile list

Type: Web
Category: CONTENT
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

keyword Keyword used for search string 512

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

FortiOS 6.0.10 Log Reference 1022

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12293 - LOG_ID_WEB_CONTENT_SEARCH

Message ID: 12293

Message Description: LOG_ID_WEB_CONTENT_SEARCH
Message Meaning: Search phrase detected
Type: Web
Category: CONTENT
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

FortiOS 6.0.10 Log Reference 1023

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

keyword Keyword used for search string 512

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

FortiOS 6.0.10 Log Reference 1024

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12305 - LOG_ID_WEB_CONTENT_MMS_BANWORD_NOTIF

Message ID: 12305

Message Description: LOG_ID_WEB_CONTENT_MMS_BANWORD_NOTIF
Message Meaning: Web content MMS banned word
Type: Web
Category: CONTENT
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

banword Banned word string 128

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 1025

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

FortiOS 6.0.10 Log Reference 1026

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12544 - LOG_ID_URL_FILTER_BLOCK

Message ID: 12544

Message Description: LOG_ID_URL_FILTER_BLOCK
Message Meaning: URL address was blocked because it was found in the URL filter list
Type: Web
Category: URLFILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

FortiOS 6.0.10 Log Reference 1027

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log message string 512

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

urlfilteridx URL filter ID uint32 10

urlfilterlist URL filter list string 64

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12545 - LOG_ID_URL_FILTER_EXEMPT

Message ID: 12545

Message Description: LOG_ID_URL_FILTER_EXEMPT
Message Meaning: URL address was exempted because it was found in the URL filter list
Type: Web
Category: URLFILTER

FortiOS 6.0.10 Log Reference 1028

Fortinet, Inc.
Log Messages

Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

FortiOS 6.0.10 Log Reference 1029

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

urlfilteridx URL filter ID uint32 10

urlfilterlist URL filter list string 64

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12546 - LOG_ID_URL_FILTER_ALLOW

Message ID: 12546

Message Description: LOG_ID_URL_FILTER_ALLOW
Message Meaning: URL address was allowed because it was found in the URL filter list
Type: Web
Category: URLFILTER
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

FortiOS 6.0.10 Log Reference 1030

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 1031

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

url The URL address string 512

urlfilteridx URL filter ID uint32 10

urlfilterlist URL filter list string 64

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12547 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTP_BLK

Message ID: 12547

Message Description: LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTP_BLK
Message Meaning: The request contained an invalid domain name
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

FortiOS 6.0.10 Log Reference 1032

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12548 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTPS_BLK

Message ID: 12548

Message Description: LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTPS_BLK
Message Meaning: HTTP certificate request contained an invalid domain name
Type: Web
Category: URLFILTER
Severity: Notice

FortiOS 6.0.10 Log Reference 1033

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

FortiOS 6.0.10 Log Reference 1034

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12549 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTP_PASS

Message ID: 12549

Message Description: LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTP_PASS
Message Meaning: HTTP request contained an invalid name so the session has been filtered by IP only
Type: Web
Category: URLFILTER
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

FortiOS 6.0.10 Log Reference 1035

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12550 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTPS_PASS

Message ID: 12550

Message Description: LOG_ID_URL_FILTER_INVALID_HOSTNAME_HTTPS_PASS
Message Meaning: HTTPS request contained an invalid name so the session has been filtered by IP only
Type: Web
Category: URLFILTER
Severity: Information

FortiOS 6.0.10 Log Reference 1036

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

FortiOS 6.0.10 Log Reference 1037

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12551 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_SNI_BLK

Message ID: 12551

Message Description: LOG_ID_URL_FILTER_INVALID_HOSTNAME_SNI_BLK
Message Meaning: Insufficient resources
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

FortiOS 6.0.10 Log Reference 1038

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12552 - LOG_ID_URL_FILTER_INVALID_HOSTNAME_SNI_PASS

Message ID: 12552

Message Description: LOG_ID_URL_FILTER_INVALID_HOSTNAME_SNI_PASS
Message Meaning: Getting the host name failed
Type: Web
Category: URLFILTER
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

FortiOS 6.0.10 Log Reference 1039

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 1040

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12553 - LOG_ID_URL_FILTER_INVALID_CERT

Message ID: 12553

Message Description: LOG_ID_URL_FILTER_INVALID_CERT
Message Meaning: Server certificate validation failed
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

FortiOS 6.0.10 Log Reference 1041

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12554 - LOG_ID_URL_FILTER_INVALID_SESSION

Message ID: 12554

Message Description: LOG_ID_URL_FILTER_INVALID_SESSION
Message Meaning: SSL session blocked because its identification number was unknown
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

FortiOS 6.0.10 Log Reference 1042

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 1043

Fortinet, Inc.
Log Messages

12555 - LOG_ID_URL_FILTER_SRV_CERT_ERR_BLK

Message ID: 12555

Message Description: LOG_ID_URL_FILTER_SRV_CERT_ERR_BLK
Message Meaning: SSL session blocked
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 1044

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12556 - LOG_ID_URL_FILTER_SRV_CERT_ERR_PASS

Message ID: 12556

Message Description: LOG_ID_URL_FILTER_SRV_CERT_ERR_PASS
Message Meaning: SSL session ignored
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 1045

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

rcvdbyte Received Bytes uint64 20

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12557 - LOG_ID_URL_FILTER_FAMS_NOT_ACTIVE

Message ID: 12557

Message Description: LOG_ID_URL_FILTER_FAMS_NOT_ACTIVE
Message Meaning: The FortiGuard Analysis and Management Service is not active. You must enable this service

FortiOS 6.0.10 Log Reference 1046

Fortinet, Inc.
Log Messages

Type: Web
Category: URLFILTER
Severity: Critical

Log Field Name Description Data Type Length

date Date string 10

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

level Log Level string 11

logid Log ID string 10

msg Log message string 512

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

vd Virtual domain name string 32

12558 - LOG_ID_URL_FILTER_RATING_ERR

Message ID: 12558

Message Description: LOG_ID_URL_FILTER_RATING_ERR
Message Meaning: Rating error occurred
Type: Web
Category: URLFILTER
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

dstip Destination IP ip 39

FortiOS 6.0.10 Log Reference 1047

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

error URL rating error message string 256

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

referralurl string 512

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

urltype URL filter type string 8

user User name string 256

vd Virtual domain name string 32

12559 - LOG_ID_URL_FILTER_PASS

Message ID: 12559

Message Description: LOG_ID_URL_FILTER_PASS
Message Meaning: URL passed because it was in the URL filter list
Type: Web
Category: URLFILTER
Severity: Information

FortiOS 6.0.10 Log Reference 1048

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

FortiOS 6.0.10 Log Reference 1049

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

urlfilteridx URL filter ID uint32 10

urlfilterlist URL filter list string 64

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12560 - LOG_ID_URL_WISP_BLOCK

Message ID: 12560

Message Description: LOG_ID_URL_WISP_BLOCK
Message Meaning: URL blocked by Websense service
Type: Web
Category: URLFILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 1050

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 1051

Fortinet, Inc.
Log Messages

12561 - LOG_ID_URL_WISP_REDIR

Message ID: 12561

Message Description: LOG_ID_URL_WISP_REDIR
Message Meaning: URL blocked with redirect message by Websense service
Type: Web
Category: URLFILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

FortiOS 6.0.10 Log Reference 1052

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12562 - LOG_ID_URL_WISP_ALLOW

Message ID: 12562

Message Description: LOG_ID_URL_WISP_ALLOW
Message Meaning: URL allowed by Websense service
Type: Web
Category: URLFILTER
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

FortiOS 6.0.10 Log Reference 1053

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 1054

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12688 - LOG_ID_WEB_SSL_EXEMPT

Message ID: 12688

Message Description: LOG_ID_WEB_SSL_EXEMPT
Message Meaning: URL address was exempted because it was found in the ssl-exempt
Type: Web
Category: SSL-EXEMPT
Severity: Information

Log Field Name Description Data Type Length

action string 11

crlevel string 10

crscore uint32 10

date string 10

direction string 8

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

eventtype string 32

fctuid string 32

forwardedfor string 128

group string 64

hostname string 256

initiator string 64

level string 11

FortiOS 6.0.10 Log Reference 1055

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid string 10

msg string 512

profile string 64

proto uint8 3

rcvdbyte uint64 20

referralurl string 512

reqtype string 8

sentbyte uint64 20

service string 36

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

trueclntip ip 39

type string 16

unauthuser string 66

unauthusersource string 66

url string 512

urlfilteridx uint32 10

urlfilterlist string 64

user string 256

vd string 32

vrf uint8 3

12800 - LOG_ID_WEB_FTGD_ERR

Message ID: 12800

Message Description: LOG_ID_WEB_FTGD_ERR
Message Meaning: Rating error occurred (error)

FortiOS 6.0.10 Log Reference 1056

Fortinet, Inc.
Log Messages

Type: Web
Category: FTGD_ERR
Severity: Error

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

error URL rating error message string 256

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

FortiOS 6.0.10 Log Reference 1057

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12801 - LOG_ID_WEB_FTGD_WARNING

Message ID: 12801

Message Description: LOG_ID_WEB_FTGD_WARNING
Message Meaning: Rating error occurred (warning)
Type: Web
Category: FTGD_ERR
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

FortiOS 6.0.10 Log Reference 1058

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

error URL rating error message string 256

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

FortiOS 6.0.10 Log Reference 1059

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

12802 - LOG_ID_WEB_FTGD_QUOTA

Message ID: 12802

Message Description: LOG_ID_WEB_FTGD_QUOTA
Message Meaning: Daily FortiGuard quota status
Type: Web
Category: FTGD_QUOTA
Severity: Information

Log Field Name Description Data Type Length

catdesc Web category description string 64

date Date string 10

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

level Log Level string 11

logid Log ID string 10

profile Web Filter profile name string 64

quotaexceeded Quota has been exceeded string 3

quotamax Maximum quota allowed - in seconds if time-based - in bytes if uint64 20

traffic-based

quotatype Quota type string 16

quotaused Quota used - in seconds if time-based - in bytes if traffic- uint64 20

based).

subtype Log subtype string 20

FortiOS 6.0.10 Log Reference 1060

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

vd Virtual domain name string 32

13056 - LOG_ID_WEB_FTGD_CAT_BLK

Message ID: 13056

Message Description: LOG_ID_WEB_FTGD_CAT_BLK
Message Meaning: URL belongs to an blocked category within the firewall policy
Type: Web
Category: FTGD_BLK
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

FortiOS 6.0.10 Log Reference 1061

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 1062

Fortinet, Inc.
Log Messages

13057 - LOG_ID_WEB_FTGD_CAT_WARN

Message ID: 13057

Message Description: LOG_ID_WEB_FTGD_CAT_WARN
Message Meaning: URL belongs to a category with warnings enabled
Type: Web
Category: FTGD_BLK
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

FortiOS 6.0.10 Log Reference 1063

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13312 - LOG_ID_WEB_FTGD_CAT_ALLOW

Message ID: 13312

Message Description: LOG_ID_WEB_FTGD_CAT_ALLOW
Message Meaning: URL belongs to an allowed category within the firewall policy
Type: Web
Category: FTGD_ALLOW
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

FortiOS 6.0.10 Log Reference 1064

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

FortiOS 6.0.10 Log Reference 1065

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13313 - LOG_ID_WEB_FTGD_RULE_ALLOW

Message ID: 13313

Message Description: LOG_ID_WEB_FTGD_RULE_ALLOW
Message Meaning: URL belongs to an override rule
Type: Web
Category: FTGD_ALLOW
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

FortiOS 6.0.10 Log Reference 1066

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

mode string 32

msg Log message string 512

ovrdid uint32 10

ovrdtbl string 128

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

ruledata string 512

ruletype string 9

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

FortiOS 6.0.10 Log Reference 1067

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13314 - LOG_ID_WEB_FTGD_OFF_SITE_ALLOW

Message ID: 13314

Message Description: LOG_ID_WEB_FTGD_OFF_SITE_ALLOW
Message Meaning: URL belongs to an override rule
Type: Web
Category: FTGD_ALLOW
Severity: Information

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

FortiOS 6.0.10 Log Reference 1068

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

mode string 32

msg Log message string 512

ovrdid uint32 10

ovrdtbl string 128

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

ruledata string 512

ruletype string 9

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

FortiOS 6.0.10 Log Reference 1069

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13315 - LOG_ID_WEB_FTGD_QUOTA_COUNTING

Message ID: 13315

Message Description: LOG_ID_WEB_FTGD_QUOTA_COUNTING
Message Meaning: FortiGuard web filter category quota counting log message
Type: Web
Category: FTGD_QUOTA_COUNTING
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

FortiOS 6.0.10 Log Reference 1070

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

quotamax Maximum quota allowed - in seconds if time-based - in bytes if uint64 20

traffic-based

quotatype Quota type string 16

quotaused Quota used - in seconds if time-based - in bytes if traffic- uint64 20

based).

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

FortiOS 6.0.10 Log Reference 1071

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13316 - LOG_ID_WEB_FTGD_QUOTA_EXPIRED

Message ID: 13316

Message Description: LOG_ID_WEB_FTGD_QUOTA_EXPIRED
Message Meaning: FortiGuard web filter category quota expired log message
Type: Web
Category: URLFILTER
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

FortiOS 6.0.10 Log Reference 1072

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

quotamax Maximum quota allowed - in seconds if time-based - in bytes if uint64 20

traffic-based

quotatype Quota type string 16

quotaused Quota used - in seconds if time-based - in bytes if traffic- uint64 20

based).

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 1073

Fortinet, Inc.
Log Messages

13317 - LOG_ID_WEB_URL

Message ID: 13317

Message Description: LOG_ID_WEB_URL
Message Meaning: URL has been visited
Type: Web
Category: URLFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

cat Web category ID uint8 3

catdesc Web category description string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

method Rating override method by URL domain name or IP address. string 6

msg Log message string 512

policyid Policy ID uint32 10

FortiOS 6.0.10 Log Reference 1074

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13568 - LOG_ID_WEB_SCRIPTFILTER_ACTIVEX

Message ID: 13568

Message Description: LOG_ID_WEB_SCRIPTFILTER_ACTIVEX
Message Meaning: ActiveX script removed
Type: Web
Category: ACTIVEXFILTER
Severity: Notice

FortiOS 6.0.10 Log Reference 1075

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

FortiOS 6.0.10 Log Reference 1076

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13573 - LOG_ID_WEB_SCRIPTFILTER_COOKIE

Message ID: 13573

Message Description: LOG_ID_WEB_SCRIPTFILTER_COOKIE
Message Meaning: Cookie removed
Type: Web
Category: COOKIEFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

FortiOS 6.0.10 Log Reference 1077

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

FortiOS 6.0.10 Log Reference 1078

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13584 - LOG_ID_WEB_SCRIPTFILTER_APPLET

Message ID: 13584

Message Description: LOG_ID_WEB_SCRIPTFILTER_APPLET
Message Meaning: Java applet removed
Type: Web
Category: APPLETFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

FortiOS 6.0.10 Log Reference 1079

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13600 - LOG_ID_WEB_SCRIPTFILTER_OTHER

Message ID: 13600

Message Description: LOG_ID_WEB_SCRIPTFILTER_OTHER
Message Meaning: Script entity removed
Type: Web
Category: SCRIPTFILTER
Severity: Notice

FortiOS 6.0.10 Log Reference 1080

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

filtertype The script filter type string 10

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

FortiOS 6.0.10 Log Reference 1081

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13601 - LOG_ID_WEB_WF_COOKIE

Message ID: 13601

Message Description: LOG_ID_WEB_WF_COOKIE
Message Meaning: Cookie removed entirely
Type: Web
Category: COOKIEFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

FortiOS 6.0.10 Log Reference 1082

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

eventtype Web Filter event type string 32

fctuid string 32

filtertype The script filter type string 10

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 1083

Fortinet, Inc.
Log Messages

13602 - LOG_ID_WEB_WF_REFERER

Message ID: 13602

Message Description: LOG_ID_WEB_WF_REFERER
Message Meaning: Referrer removed from request
Type: Web
Category: COOKIEFILTER
Severity: Notice

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

filtertype The script filter type string 10

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

FortiOS 6.0.10 Log Reference 1084

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

vrf uint8 3

13603 - LOG_ID_WEB_WF_COMMAND_BLOCK

Message ID: 13603

Message Description: LOG_ID_WEB_WF_COMMAND_BLOCK
Message Meaning: Command blocked
Type: Web
Category: WEBFILTER_COMMAND_BLOCK
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

FortiOS 6.0.10 Log Reference 1085

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

date Date string 10

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

forwardedfor string 128

group User group name string 64

hostname The host name of a URL string 256

level Log Level string 11

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

reqtype Request type string 8

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

trueclntip ip 39

type Log type string 16

unauthuser string 66

unauthusersource string 66

user User name string 256

FortiOS 6.0.10 Log Reference 1086

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

vd Virtual domain name string 32

vrf uint8 3

13616 - LOG_ID_CONTENT_TYPE_BLOCK

Message ID: 13616

Message Description: LOG_ID_CONTENT_TYPE_BLOCK
Message Meaning: Blocked by HTTP header content type
Type: Web
Category: CONTENT
Severity: Warning

Log Field Name Description Data Type Length

action Security action performed by WF string 11

agent User agent - eg. agent="Mozilla/5.0" string 64

contenttype Content Type from HTTP header string 64

crlevel Client Reputation level string 10

crscore Client Reputation Score uint32 10

date Date string 10

direction Direction of the web traffic string 8

dstintf Destination Interface string 32

dstintfrole string 10

dstip Destination IP ip 39

dstport Destination Port uint16 5

eventtime uint64 20

eventtype Web Filter event type string 32

fctuid string 32

from MMS-only - From/To headers from the email string 128

group User group name string 64

hostname The host name of a URL string 256

initiator The initiator user for override string 64

level Log Level string 11

FortiOS 6.0.10 Log Reference 1087

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

logid Log ID string 10

msg Log message string 512

policyid Policy ID uint32 10

profile Web Filter profile name string 64

proto Protocol number uint8 3

rcvdbyte Received Bytes uint64 20

referralurl string 512

reqtype Request type string 8

sentbyte Sent Bytes uint64 20

service Service name string 36

sessionid Session ID uint32 10

srcintf Source Interface string 32

srcintfrole string 10

srcip Source IP ip 39

srcport Source Port uint16 5

subtype Log subtype string 20

time Time string 8

to MMS-only - From/To headers from the email string 512

type Log type string 16

unauthuser string 66

unauthusersource string 66

url The URL address string 512

user User name string 256

vd Virtual domain name string 32

13632 - LOGID_HTTP_HDR_CHG_REQ

Message ID: 13632

Message Description: LOGID_HTTP_HDR_CHG_REQ
Message Meaning: Depends on info in msg field
Type: Web
Category: HTTP_HEADER_CHANGE
Severity: Information

FortiOS 6.0.10 Log Reference 1088

Fortinet, Inc.
Log Messages

Log Field Name Description Data Type Length

agent string 64

chgheaders string 20480

date string 10

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

group string 64

level string 11

logid string 10

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

transid uint32 10

type string 16

url string 512

user string 256

vd string 32

vrf uint8 3

13633 - LOGID_HTTP_HDR_CHG_RESP

Message ID: 13633

Message Description: LOGID_HTTP_HDR_CHG_RESP

FortiOS 6.0.10 Log Reference 1089

Fortinet, Inc.
Log Messages

Message Meaning: Depends on info in msg field

Type: Web
Category: HTTP_HEADER_CHANGE
Severity: Information

Log Field Name Description Data Type Length

agent string 64

chgheaders string 20480

date string 10

dstintf string 32

dstintfrole string 10

dstip ip 39

dstport uint16 5

eventtime uint64 20

group string 64

level string 11

logid string 10

policyid uint32 10

profile string 64

proto uint8 3

sessionid uint32 10

srcintf string 32

srcintfrole string 10

srcip ip 39

srcport uint16 5

subtype string 20

time string 8

transid uint32 10

type string 16

url string 512

user string 256

vd string 32

vrf uint8 3

FortiOS 6.0.10 Log Reference 1090

Fortinet, Inc.
Copyright© 2020 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., in
the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be
trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and
other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding
commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s
General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such
event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be
limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features or
development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and
guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most
current version of the publication shall be applicable.