Appendix a Log Report Types, Web Activity | Fortinet FortiLog-400

FortiLog Administration Guide Version 1.6

Appendix A: Log Report Types

Your FortiLog unit is can generate over 130 different types of log reports. Listed here are the log reports and a short description.

Network Activity

Network activity log reports record total network traffic activities by a specific time and direction as well as top traffic activities.

Log report	Description

Traffic By Date And Direction	Incoming and outgoing network traffic in kilobytes for a
	specified day or range of days.
Traffic By Day Of Week And Direction	Daily incoming and outgoing network traffic in kilobytes
	for a specified week.
Traffic By Hour Of Day And Direction	Hourly incoming and outgoing network traffic in kilobytes
	for a specified period.
Traffic By Direction	Report of total incoming and out going network traffic in
	kilobytes.
Traffic By Top Services And Direction	Network traffic by Internet service by incoming and
	outgoing network traffic in kilobytes.
Traffic By Top Sources	Network traffic volume in megabytes by source IPs.

Traffic By Top Sources And Top	Network traffic by the source IPs and Internet services in
Services	kilobytes.
Traffic By Top Sources And Top	Network traffic by the source IPs and destination IPs in
Destinations	kilobytes.
Traffic By Top Destinations	Network traffic by the destination IPs in kilobytes.

Traffic By Top Destinations And Top	Network traffic by the destination IPs and Internet
Services	services in kilobytes.
Traffic By Top Destinations And Top	Network traffic of the top destination IPs and their source
Sources	IPs in kilobytes.

Web Activity

Web Activity reports record total web access activities including blocked site access attempts by a specific time and top web access activities.

Report	Description

Web Traffic By Date	Web traffic in megabytes for a specified day or range of
	days.

Web Traffic By Day Of Week	Daily web traffic in megabytes for a specified week.

Web Traffic By Hour Of Day	Hourly web traffic in kilobytes for the specified period.

FortiLog Administration Guide

05-16000-0082-20050115

113

Image 113

Fortinet FortiLog-400, FortiLog-100, FortiLog-800 manual Appendix a Log Report Types, Network Activity, Web Activity, 113

Contents

January 15, 2004 FortiLog-100 FortiLog-400 FortiLog-800 Regulatory Compliance Version 1.6 January 15 05-16000-0082-20050115Trademarks Table of Contents Managing the FortiLog unit Config Network Reports 103 Setting folder and file properties104 110 FortiLog-400 FortiLog-100 FortiLog-800 Introduction Operational Modes Active Mode Introduction Passive Mode FortiLog documentation Explains how to install and set up the FortiLog unitAbout this guide FortiGate documentation Explains how to configure VPNs using the web-based managerRelated documentation FortiClient documentation FortiManager documentationFortiMail documentation Fortinet Knowledge Center Customer service and technical support Customer service and technical support Checking the package contents Setting up the FortiLog unit FortiLog-100 2.5 kg FortiLog-400 11 kg FortiLog-80014 kg Hardware specifications DimensionsWeight Power requirements Planning the installationEnvironmental specifications Air flow Connecting the FortiLog unit Connecting the FortiLog unitFortiLog unit Management PC To connect the FortiLog unit to the network Using the web-based manager Configuring the FortiLog unitFactory defaults Administrator To connect to the web-based manager To configure the FortiLog unit using the web-based manager Using the command line interfaceTo configure the FortiLog unit using the CLI Set system interface port1 mode static ip IPaddress netmask Set system dns primary IPaddress Using the front panel buttons and LCDSet the primary DNS server IP address Configuring the FortiLog unit Configuring FortiGate unit running FortiOS Connecting to the FortiLog UnitGo to Log&Report Log Config Sending device logs to the FortiLog unit FortiGate 2.8 log settings Configuring FortiGate devices running FortiOS FortiGate 2.5 Log settings Configuring FortiMail devices To add a device Adding a deviceGroups from this tab Unregistered Defining device port interfaces To create a device group Go to System Devices Groups Creating Device Groups Status Managing the FortiLog unitStatus Interval Operating ModeRefresh Alerts Changing the FortiLog host name To change the operating mode in the CLIChanging operating modes Set system opmode activepassive Changing the firmware To change the firmware using the web-based managerViewing system resources information To change the firmware using the CLI Installing firmware from a system rebootExecute restore image namestr tftpip Execute restore image FortiLog400-v120.out Press any key to enter configuration menu To install firmware from a system rebootImmediately press any key to interrupt the system startup Enter Local Address To test a new firmware image before installing it Testing a new firmware imageFollowing message appears Enter File Name image.out Save as Default firmware/Run image without savingD/R Installing a backup firmware imageGet system status You can test the new firmware image as required Type B To install a backup firmware image To switch to the backup firmware image Switching to a backup firmware imageSwitching to the default firmware image To switch back to the default firmware image Backing up system settingsExecute reboot To backup up system settings Go to System Status Status Restore factory default system settings Restoring system settingsTo restore system settings Go to System Status Status Restoring a FortiLog unit Press any key to begin download To upload the firmware image to the FortiLog unit Network Config Config RAID Config Policy Log settingsLog to Host Port Log policy Config PolicyCSV format Levels Description Generated by Time AdminOptions Language Configure Administrator access Administrator options Administrator account levels To add an administrator account Go to System Config Admin Devices Active modeChanging the Administrator password Editing device information Device listAdding and registering a device To edit a device Go to System Devices Alert EmailServer Creating a new device alert Device Active modeLocal Attack Type Entry and listing Level of wait interval Attack Type Virus Type AlertsTo add a device alert Go to System Alert Email Device Window Network SharingDefining IP aliases IP aliases To set host alias names Go to Reports IP Aliases Reports To create a report Go to Reports ConfigCreating and generating a report Select New and enter a name for the report To define report parameters Go to Reports Config Configuring report parametersSet the following Select Run now To set the report queries Go to Reports Config Configuring a report queryResolve Service Names Ranked Reports show top Select a report from the list Select Queries Creating a query profile To select the devices Go to Reports ConfigSelecting the devices for the report To create a query profile Creating a device profile To set the filtering on a log report Go to Reports ConfigSelect filtering options To create a device profile To create a scheduled report Go to Reports Config Setting a report scheduleCreating a filter profile To create a report filter profile Choosing the report destination and format Creating a report schedule profileSelect Schedule Select a day from the following To create a report schedule profile Creating a report destination and format profile To generate a report on demand Go to Reports ConfigReports on demand To create a pre-defined output selection To view a generated report Go to File Browse Reports Viewing reports Individual reports Roll up report Creating and generating a report To create a report Go to Reports Config VulnerabilityVulnerability reports Selecting plug-ins Per device Resolve Host Names Resolve Service NamesSelecting report result parameters Creating a plug-in profile To select the plug-ins Go to Reports Config VulnerabilitiesSelecting the scan targets for the report To create a plug-in profile To create a scan target profile Creating a scan target profileTo add additional devices Browse/Reports hard disk FileEmail list As an email attachment Select the report name from the list of completed reports Viewing the vulnerability report Using Logs Viewing logs Log view interface To view the device log files Go to File Browse Logs Finding log informationSelect the column header to change the sort order between Ascending and descending order Basic log filter Alert level Importing log filesTo import a log file Go to File Browse Logs Match Up and Down arrows Log Search Log watch Active modeTo set log watching Go to File Browse Logs Show Up and Down arrows Sort list Event correlation Active mode Event correlation Active mode Connecting to the FortiLog file system Using the FortiLog unit as a NAS Select Enable for a file sharing protocol Providing access to the FortiLog hard diskSelecting a file sharing protocol Adding and modifying user accounts Adding and modifying group accounts Assigning access to foldersTo add a user group Go to Network Sharing Groups Select Create New Windows sharing configuration NFS share configuration Modifying the user or group folder access Owner Setting folder and file propertiesTo set file and folder permissions Go to File Browse Files CLI documentation conventions FortiLog CLI reference Connecting to the FortiLog-800 console Connecting to the CLIFortiLog-800 login To connect to the FortiLog-800 console Welcome Setting administrative access for SSH or TelnetTo use the CLI to configure SSH or Telnet access Connecting to the FortiLog CLI using Telnet Connecting to the FortiLog CLI using SSHTo connect to the CLI using SSH To connect to the CLI using Telnet Execute branch CLI commandsFortiLog CLI commands include Get branch Use get to display settings, logs, or system informationGet command architecture Get system admin Get log logsettingGet report resolve Get report aliases Use set alertemail to configure alert mails Use set to configure settings, logs, or system informationSet alertemail command architecture Set branch Namestr is the user name String is the passwordBelow Set alertmail local time 0.5 1.0 3.0 6.0 Settings originate from a singe source IP CLI commandsSet alertmail device enable add leveltime Set console Use set console to set console configuration Set log Use set log to configure log settingsSet log command architecture YY-MM-DD 100 101 102 103 Set NAS Set report Set report command architectureSet system 104 105 106 107 0.0 108Trusthoststr is trusted host IP address Netmaskstr is the netmask 109 Unset branch 111 112 Network Activity Appendix a Log Report TypesWeb Activity 113 FTP Activity Mail Activity Terminal Activity115 Mail activity reports record Email traffic and connections Web Filter Activity Intrusion ActivityAntivirus Activity 117 Mail Filter Activity VPN Activity Content Activity 119 120 121 Index Index 122 123 124