Media Access Control (MAC) Address
MAC address logs provide information about MAC addresses that the FortiGate unit sees on the network as well as those removed from the network. These log messages are stored in the event log (as subtype network; you can view these log messages in Log & Report > Event > Event Log) and are, by default, disabled in the CLI. You can enable logging MAC addresses using the following command syntax:
config log setting
set neighbor-event enable
end
When enabled, a new log message is recorded every time a MAC address entry is added to the ARP table, and also when a MAC address is removed as well. A MAC address log message is also recorded when MAC addresses are connected to the local switch, or from a FortiAP or FortiSwitch unit.