Hot!No Antivirus logs

Author
Diabolicus23
Bronze Member
  • Total Posts : 54
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/05/30 01:00:02
  • Status: offline
2015/04/03 03:16:14 (permalink)
0

No Antivirus logs

Hi,
 
it seems that my FortiGate does not log antivirus events...
I've tried to download EICAR files and it is correctly blocked with antivirus replacement message but in the log section the antivirus subsection is empty.
 
I've also tried to give the "set extended-utm-log enable" option to the antivirus profile but nothing has changed.
 
 
Idea?
Thanks
#1
Christopher McMullan_FTNT
Gold Member
  • Total Posts : 415
  • Scores: 34
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
Re: No Antivirus logs 2015/04/03 05:11:25 (permalink)
0
Just bringing the whole context to bear, you also need to make sure the following settings are enabled:
-within the A/V profile, you need to enable virus logging:
config antivirus profile
edit <profile_name>
set av-virus-log enable
end
-the firewall policy the profile is applied to cannot have logging disabled:
config firewall policy
edit <int>
set logtraffic {all | utm} //--but not 'set logtraffic disable'
end
-logging to at least one destination needs to be enabled:
config log {memory | disk | fortianalyzer {1 | 2 | 3} | syslogd {1 | 2 | 3} | webtrends | fortiguard} setting
set status enable
end
-the destination cannot have those events filtered out:
config log {memory | disk | fortianalyzer {1 | 2 | 3} | syslogd {1 | 2 | 3} | webtrends | fortiguard} filter
set blocked enable //--but not 'set blocked disable'
end
 
I hope this helps! Check those other parameters, and make sure you logged out and logged back into the GUI after generating the log event, in order for A/V events to have their section appear under Log & Reports.
 
If you still can't see the log events, it may be worth checking in the CLI. We can fill in the commands for that if it comes to it.

Regards,
Chris McMullan
Fortinet Ottawa
#2
Diabolicus23
Bronze Member
  • Total Posts : 54
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/05/30 01:00:02
  • Status: offline
Re: No Antivirus logs 2015/04/03 05:32:53 (permalink)
0
Hi Chris,
 
I've checked and all the settings/options are as they should be.
Another info: I've the same exact antivirus profile in a 300D with FortiOS 5.0.9 and antivirus logs appear; in 500D with 5.0.10 they don't.
#3
Christopher McMullan_FTNT
Gold Member
  • Total Posts : 415
  • Scores: 34
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
Re: No Antivirus logs 2015/04/03 05:54:44 (permalink)
0
-What destination are you logging to?
-Do any other UTM logs appear?
 
Could you run 'get sys stat | grep Log' and see what the status of the Log Hard Disk appears as, if you're logging to disk, or else using store-and-forward to transmit your logs to a remote server?
 
Two other things to check:
1. Debug the logging daemon
-and-
2. Check the logs through the CLI
 
1. Debugging
diag debug reset
diag debug enable
diag debug application miglogd -1
<generate the log event by downloading the EICAR file, then...>
diag debug reset
diag debug disable
 
2. Viewing logs via the CLI
-Filter for A/V logs
McFortiGate # exec log filter category
Available categories:
0: traffic
1: event
2: utm-virus
3: utm-webfilter
4: utm-ips
5: utm-spam
6: contentlog
7: anomaly
8: voip
9: utm-dlp
10: utm-app-ctrl
11: netscan
 
exec log filter category 2
exec log display
 
 

Regards,
Chris McMullan
Fortinet Ottawa
#4
Luis.gnr
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/01/02 15:32:58
  • Status: offline
Re: No Antivirus logs 2019/01/02 15:40:54 (permalink)
0
I have recently had the same issue and bumped with this forum while trying to find an answer. Finally, I found that:
 
1) FortiClient (not FortiGate) Web filter was detecting this first, so it never reached the FortiGate
2) Once I disabled FortiClient Web filter, Fortigate detected this virus through web filter, so no antivirus logs were generated, only Web filter
 
Once I disabled both FortiClient Web filter, and the filter in the policy of the FortiGate, I was able to see the logs for eicar in the antivirus logs.
#5
Jump to:
© 2019 APG vNext Commercial Version 5.5