Fortinet 3.0 MR7 manual Viewing historical log messages

Viewing log messages Log

Figure 1: Viewing current logs

Column Settings

Devices	Select the type of device you want to view logs from. If you select
	All FortiGates, all log messages from all registered FortiGate units
	appear.
Log types	Select to view a different device’s logs, or a different log type.
Stop	Select to stop refreshing the log view.
	This option appears only when refreshing is started.
Start	Select to start refreshing the log view.
	This option appears only when refreshing is stopped.
Column Settings	Select to change the columns to view and the order they appear
	on the page. For more information, see “Displaying and arranging
	log columns” on page 97.
Formatted Raw	Select a view of the log file. Selecting Formatted (the default)
	displays the log files in columnar format. Selecting Raw, displays
	the log information as it actually appears in the log file.
View n per page	Select the number of rows of log entries to display per page. You
	can choose up to 1000 entries.

Note: Log messages that are received from a log aggregation device are scheduled transfers, and not real-time messages, because log aggregation devices do not appear in the Real-time tab. Individual high availability (HA) cluster members also do not appear in the Real-time tab because HA members are treated as a single device.

Viewing historical log messages

The Historical tab in Log > Log Viewer displays logs for a selected device and log type for a specific time range. When viewing log messages, you can filter the information to find specific event information.

For more information about log messages, see the FortiGate Log Message Reference.

	FortiAnalyzer Version 3.0 MR7 Administration Guide
92	05-30007-0082-20080908