FortiOS FSSO log messages

FortiOS FSSO log messages

There are two types of FortiOS log messages — firewall and event. FSSO related log messages are generated from authentication events. These include user logon and log off events, and NTLM authentication events. These log messages are central to network accounting policies, and can also be useful in troubleshooting issues. For more information on firewall logging, see Enabling security logging on page 507. For more information on logging, see the FortiOS Handbook Logging and Reporting guide.

 

Enabling authentication event logging

For the FortiGate unit to log events, that specific type of event must be enabled under logging.

When VDOMs are enabled certain options may not be available, such as CPU and memory usage events. You can enable event logs only when you are logged on to a VDOM; you cannot enable event logs globally.

To ensure you log all the events needed, set the minimum log level to Notification or Information. Firewall logging requires Notification as a minimum. The closer to Debug level, the more information will be logged.

To enable event logging:

1. Go to Log&Report > Log Config > Log Settings.

2. In Event Logging, select

System activity event              All system-related events, such as ping server failure and gateway status.

User Activity event                   All administration events, such as user logins, resets, and configuration updates.

3. Select Apply.

List of FSSO related log messages

 

Message ID                      Severity                            Description
43008                                 Notification                         Authentication was successful
43009                                 Notification                         Authentication session failed
43010                                 Warning                              Authentication locked out
43011                                 Notification                         Authentication timed out
43012                                 Notification                         FSSO authentication was successful

 

Message ID                      Severity                            Description
43013                                 Notification                         FSSO authentication failed
43014                                 Notification                         FSSO user logged on
43015                                 Notification                         FSSO user logged off
43016                                 Notification                         NTLM authentication was successful
43017                                 Notification                         NTLM authentication failed

 

For more information on logging, see the FortiOS Handbook Logging and Reporting guide.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.