Fortinet FortiRecorder 100D - Searching logs

System monitoring Page 97 FortiRecorder 2.4.2 Administration Guide
To delete a log file
1. Go to one of the log types, such as Monitor > Log Viewer > Event.
2. Either:
• To delete all log files, mark the check box in the column heading. All rows’ check boxes
will become marked.
• To delete some log files, mark the check box next to each file that you want to delete.
3. Click Delete.
See also
• Downloading log messages
Searching logs
When viewing attack logs, you can locate a specific log using the event log search function.
To search an attack log
1. Go to one of the log types, such as Monitor > Log Viewer > Event.
2. Click Search.
A dialog appears.
3. Configure these settings:
Setting name Description
Keyword Type all or part of the exact word or phrase you want to search for.
The word may appear in any of the fields of the log message (e.g.
Action and/or Message), in any part of that field’s value. If entering
multiple words, they must occur uninterrupted in that exact order.
For example, entering admin as a keyword will include results such
as User admin2 logout from GUI(172.16.1.15) where part
of the word appears in the middle of the log message. However,
entering User logout would not yield any results, because in the
log messages, those two words are always interrupted by the name of
the account, and therefore do not exactly match your search key
phrase.
Depending on your setting of Match condition, you may be able to
use asterisks as wild cards to match multiple words.
This setting is optional.
Message Type all or part of the exact value of the Message (msg) field of the log
messages that you want to find.
This setting is optional.
Log ID Type all or part of the ID number of the log messages that you want to
find.
This setting is optional.