Logging, Monitoring, and Reporting

Logging is the act of recording events as they happen on your network devices. Think of it as a security camera that records everything in the lobby of your building. Every time someone enters or leaves, the camera saves a clip with a timestamp, a face, and what they did. In a Fortinet network, every device — like a FortiGate firewall — generates logs for actions such as a connection attempt, a blocked virus, or an admin login. These logs are stored locally on the device itself, but that is like keeping all your security tapes stacked in the lobby closet: hard to review and easy to lose. That is why most organisations send logs to a central log collector, such as FortiAnalyzer, which aggregates logs from hundreds or thousands of devices into one searchable database.

Monitoring is the real-time dashboard that shows you what is happening right now. If logging is the recorded tape, monitoring is the live security guard watching the camera feed. Monitoring tools like the FortiGate dashboard or FortiAnalyzer dashboard display current sessions, bandwidth usage, blocked threats, and system health. They use thresholds to trigger alerts — for example, if the CPU on a FortiGate hits 90%, an alert pops up. Monitoring does not store long-term data; it fades away like a live broadcast. Its purpose is to give you immediate awareness so you can respond to a problem as it occurs.

Reporting is the weekly or monthly summary that turns logs into trends. While logs contain every raw event and monitoring shows the moment, reporting aggregates data over time to answer questions like: How many malware attacks did we block last month? Which department downloaded the most unauthorised applications? Reports in Fortinet environments are generated by FortiAnalyzer or FortiCloud, and they can be scheduled (daily, weekly, monthly) or run on demand. Reports are used for compliance (proving to auditors that you meet security standards), for security analysis (spotting a slow-brewing attack), and for capacity planning (realising you need more bandwidth because traffic keeps increasing).

Now, why do these three matter together? Because they form a cycle. Logging creates the data. Monitoring lets you react in the moment. Reporting lets you learn and improve. In the NSE7 exam, you must understand how to configure the log settings on a FortiGate (log to local disk, to FortiAnalyzer, or to syslog), how to interpret log severity levels (emergency, alert, critical, error, warning, notice, informational, debug), and how to generate reports that meet organisational needs.

Logs themselves have types:

Log severity levels range from 0 (emergency) to 7 (debug). For the exam, you need to know that if a system is unusable, the log will be severity 0 emergency. Most day-to-day operational logs are severity 5 notice or severity 6 informational.

FortiAnalyzer is the central tool for logging and reporting in Fortinet environments. It can receive logs from FortiGates, FortiSwitches, FortiAPs, and even third-party devices via syslog. FortiAnalyzer then indexes the logs, making them searchable, and runs report templates that you can customise. The exam will test you on configuring FortiAnalyzer as a log collector, setting up log shipping from a FortiGate, and scheduling report generation.

Another key concept is syslog — a standard protocol for sending log messages across a network. FortiGate can send logs to any syslog server, but the exam focuses on FortiAnalyzer integration because that is what Fortinet recommends for full functionality.

Finally, understand that logging and monitoring have a cost. Every log consumes disk space, network bandwidth, and processing power. If you log everything at debug level, your FortiGate will slow down and fill storage quickly. In real life, you log at appropriate levels: informational for traffic logs, warning for security logs, and only enable debug during troubleshooting. The exam will present scenarios where you must choose the correct log level or the right storage destination.

Imagine you are the IT administrator for a mid-sized company called ‘BrightCloud’, which has two branch offices, a main headquarters, and 500 employees. Your CEO just received a nasty email from a client claiming their data was stolen. You need to prove whether a breach occurred and, if so, how it happened. Here is exactly what you do.

Step 1: Check the live monitoring dashboard. You log into your FortiGate (the firewall at HQ) and look at the real-time dashboard. You see current sessions — a few thousand, which is normal for the middle of the week. No spikes. No blocked traffic spikes. The CPU and memory are fine. The monitoring gives you an immediate sense: nothing weird is happening right now.

Step 2: Query historical logs. You open FortiAnalyzer and search for all traffic logs from the client’s IP range over the past week. You filter the logs to show only events with severity ‘error’ or ‘critical’. You find three logs: an intrusion prevention system (IPS) alert that blocked a known malware signature from the client’s IP at 2:34 AM on Tuesday, a virus detection on an email attachment from the same IP at 3:12 AM, and a successful VPN login from the client’s IP at 3:30 AM. That is suspicious — the attacker used a valid VPN credential to get inside.

Step 3: Generate a detailed report. You run a pre-built ‘Security Incident Report’ in FortiAnalyzer for the client’s IP range and the date range. The report includes a timeline of events, the exact bytes transferred, and the username that logged in via VPN. You export the report as a PDF.

Step 4: Correlate with user identity. You check the identity logs and see that the VPN login used the username ‘jdoe@brightcloud.com’. You contact John Doe in accounting and discover he never logs in at 3:30 AM. His password was weak — he used ‘Password123’. The attack was a credential theft followed by lateral movement.

Step 5: Take action. Based on the report, you reset John’s password, enable multi-factor authentication (MFA) on all VPN accounts, and create a new log monitoring rule that triggers an alert if any VPN login occurs outside business hours.

What did you use from logging, monitoring, and reporting? - Logging: the raw traffic, security, and VPN logs stored on FortiAnalyzer. - Monitoring: the real-time dashboard that showed nothing was actively wrong. - Reporting: the PDF report that you handed to your CEO and later to the client as proof of response.

In this real-world scenario, you discovered a breach that happened days ago, but without logs, you would have had no evidence. Without monitoring, you would not have known that the attack was over. Without reporting, you could not have communicated the incident to management in a professional format. That is why every NSE7 security professional must master these three pillars.