Policy UUID - Logs & Reports

[faizanshaikh_net]

Friends,

Why is it that I see policy UUID in some of the logs while it is absent in others?

[emnoc]

You can  enable  UUID logging  or lack of. It's very help if you are tacking items by UUID. I use it a lot btw.

global options

set log-uuid policy-only

Ken

[faizanshaikh_net]

Hi Ken,

Actually, I could see some unusual logs in my Logs & Reports section. There is a policy which is disabled for logging completely, yet I see that there are huge logs generated through it. I am assuming that these logs are junk. When I right click the policy after enabling it, and select "matching logs" I can only see the logs with UUID associated to them.

I am pretty new to Fortigates :)

[emnoc]

There is a policy which is disabled for logging completely, yet I see that there are huge logs generated through it.

Explain? How could that be?

If you have logging enable for  category traffic, &  traffic that matches that fwpolicy , you will send a log  message. If you have UUID enable for policy,  the log message is tagged with the  UUID. There's no way you can have it disable and still see logging imho & I don't know what you mean by "junk logs".

Login thru ssh or jsconsole  and find  the firrewallpolicy and look for the log traffic set command? What is it set for?

example

  show full firewall  policy 7 | grep log

        set logtraffic all

        set logtraffic-start disable

Ken

[faizanshaikh_net]

Hi Ken,

show firewall policy 53 | grep log         set logtraffic disable

As you can see that the logs have been disabled yet I could see traffic from this policy in Logs & Reports.

Regards,

Faizan

show firewall policy 53 | grep log

        set logtraffic disable

[emnoc]

what does a full show for that policy

e.g

show full  firewall policy  53 | grep log

ken

[MikePruett]

Another thing, is the traffic you are seeing recent or is it historical from before logging was disabled (if that was the case)

[faizanshaikh_net]

Hi Mike,

I upgraded Fortigate from 5.2.8 to 5.2.9 and I cannot see policy ID 53 anymore. But similar problem exists with another policy. I am able to see real-time logs from this policy which I created yesterday and disabled logging. Still I see huge logs in my Logs & Reports. These are fresh logs.

 show full firewall policy  71 | grep log         set logtraffic disable         set logtraffic-start disable

Regards,

Faizan

[emnoc]

Hmmm.

Are you running HA pairs?

Can you do  the following  from the cli;

execute log filter cat 0

execute log filter field policyid 71

execute log filter field vd <0> INSERT THE  VDOM.index number if your in a multi-vdom mode ( id 0  == root  btw )

then

execute log display

Do you have logs on the screen?   keep in mind in a  master/standby cluster  the  logs will be on the active cluster unit for that vdom.

Your situation does not seem normal and something is over looked.