Logging, Monitoring, and Management
Core concepts
FortiGate logging can be local, to FortiAnalyzer, syslog, or cloud services. Log settings are per-policy or global, and log level (emergency through debug) controls verbosity. Traffic logs record sessions; event logs record system events; security logs capture UTM detections. Understand when to use FortiAnalyzer for long-term retention, reporting, and correlation versus local disk logs for quick troubleshooting.
Monitoring tools
Know the dashboards, session monitors, and CLI diagnostics. Useful commands include diagnose sniffer packet for packet capture, get system status for firmware, and diagnose debug flow for following a packet through policy and routing decisions. Questions often ask which tool to use for a specific symptom-choose debug flow for policy/route decisions, sniffer for raw packets.
Traps to watch
- Logging disabled on a policy means no traffic logs even if sessions occur.
- Local logs are limited by disk size and may not persist across reboots depending on configuration.
- Time zone and NTP mismatch corrupts log correlation across devices.
- Administrator profiles (RBAC) restrict what a logged-in admin can see and change; a read-only admin cannot change config.
- Backups and configuration revisions are part of management hygiene.
Rule of thumb
Match the tool to the question: debug flow for "why was this packet dropped," sniffer for "what is on the wire," FortiAnalyzer for "show me trends and reports." For any "no logs" issue, first confirm logging is enabled on the matching policy and that the log destination is reachable.