You can use the web UI to view and download locally stored log messages. (You cannot use the web UI to view log messages that are stored remotely on Syslog or FortiAnalyzer devices.)

Depending on the type of log, some log messages cannot be viewed from the web UI.

Log messages are in human-readable format, where each column’s name, such as Source (src in Raw view), indicates its contents.

To assist you in forensics and troubleshooting false positives, if the request matched an attack signature, the part of the packet that matched is highlighted in yellow.

An attack’s origin is not always the same as the IP that appears in your logs. Network address translation (NAT) at various points between a web browser and your web servers can mask the original IP address of the attacker. Depending on your configuration of Use X-Header to Identify Original Client’s IP, attack logs’ Source column may contain the IP address of the client according to X-Forwarded-For: or a similar header in the HTTP layer, not the SRC field in the IP header. In that case, the corresponding traffic log’s Source column will not match, since it reflects the IP layer. (Typically in that scenario, the connection has been relayed by a load balancer or proxy, and therefore the IP would be that of the load balancer, which is not the real origin of the attack.) Relatedly, if Shared IP is enabled, FortiWeb will attempt to differentiate innocent clients that share the same public address with an attacker according to the IP layer SRC field due to NAT.

Not all attack detections will be logged. In some cases, only one entry will be logged when there are many attack instances. See “Log rate limits”. Relatedly, server information disclosure detections will not be logged if you have configured Action to be Erase, no Alert. See “Blocking known attacks & data leaks”.