Monitoring, Logging, and Reporting
This domain tests operational visibility: finding a message, proving what happened to it, and producing reports. You need to know log types, message tracking, quarantine workflow, and where logs are stored.
Logs and tracking
- FortiMail generates email, antispam, antivirus, content, system, admin, and HA logs. Local logs can be stored on disk; syslog and FortiAnalyzer provide external retention.
- Message tracking searches by sender, recipient, subject, message ID, and time. Use it to follow a message through accept, scan, queue, relay, and delivery.
- Log settings must be enabled; if a category is not logged, you cannot reconstruct it later.
- Time synchronization matters. Mismatched NTP or time zones make correlation across FortiMail, mail server, and FortiAnalyzer unreliable.
Quarantine and reports
- Personal quarantine holds spam or content for individual users; system quarantine is administered by staff. Release and delete actions are permission-controlled.
- Releasing a message does not re-run all filters; a released message can still be malicious.
- Report profiles schedule statistics such as top senders, recipients, spam, and virus detections.
- Alerts and SNMP can notify on HA failover, disk thresholds, or service failures.
Worked example
A user says an expected invoice never arrived. Search message tracking for the recipient and time window. If the email log shows acceptance and relay to the internal server, check the internal server and the user's junk folder. If the antispam log shows quarantine, release after review. If there is no record at all, check MX and DNS, access control rules, and whether the connection reached FortiMail. Reason: each result points to a different layer, so start from the message record rather than guessing.
Traps
- Assuming FortiMail logged a message when the relevant log category was disabled.
- Searching only by subject when the subject was rewritten by tagging.
- Releasing quarantine without reviewing the detection.
- Ignoring time-zone differences during correlation.
- Letting local log storage fill the disk; know retention and external logging options.