# Logging, Monitoring, and Reporting

> Chapter 14 of the Courseiva FORTINET-NSE7 curriculum — https://courseiva.com/learn/fortinet-nse7/logging-monitoring-and-reporting

**Official objective:** 6.1 — Configure logging, monitor security events, and generate reports

## Introduction

Logging, monitoring, and reporting: the three-legged stool of network security. Without them, you are flying blind — you have no idea who is knocking on your network door, what they are doing, or whether an attack already succeeded. For your NSE7 exam, mastering these concepts is non-negotiable because Fortinet’s security fabric is built on collecting, analysing, and acting on logs from firewalls, switches, and endpoints.

## The Kitchen Log Analogy

Have you ever wondered how a restaurant manager knows exactly which dish sold out first, which chef is falling behind, and whether the health inspector is coming next week?

Imagine you run a busy restaurant. Every night, your waitstaff writes down every order on a big kitchen log. Each order includes what was ordered, who cooked it, what time it was fired, and whether the customer complained. That log is your logging — a raw, timestamped record of every event that happens in your kitchen.

But you don't want to read through hundreds of pages of orders every morning. So you have a kitchen monitor — a live feed that shows you, right now, which orders are backed up, which chef is running low on ingredients, and whether the fryer temperature just spiked dangerously. That real-time dashboard is your monitoring — it alerts you to problems as they happen, so you can react instantly.

At the end of the week, you sit down with the log and the monitor data to write a weekly performance report. You identify trends: the grilled cheese always sells out on Wednesdays, Chef Maria is 20% faster than Chef Tom, and the fryer alarm went off six times this week. That report helps you decide to order more cheese, retrain Tom, and schedule a maintenance check. That is your reporting — turning collected data into actionable intelligence.

Without the log, you have no memory. Without the monitor, you are blind in the moment. Without the report, you cannot improve. The kitchen log system makes your restaurant run smoothly, and the same principle powers security logging and monitoring for networks.

## Core explanation

Logging is the act of recording events as they happen on your network devices. Think of it as a security camera that records everything in the lobby of your building. Every time someone enters or leaves, the camera saves a clip with a timestamp, a face, and what they did. In a Fortinet network, every device — like a FortiGate firewall — generates logs for actions such as a connection attempt, a blocked virus, or an admin login. These logs are stored locally on the device itself, but that is like keeping all your security tapes stacked in the lobby closet: hard to review and easy to lose. That is why most organisations send logs to a central log collector, such as FortiAnalyzer, which aggregates logs from hundreds or thousands of devices into one searchable database.

Monitoring is the real-time dashboard that shows you what is happening right now. If logging is the recorded tape, monitoring is the live security guard watching the camera feed. Monitoring tools like the FortiGate dashboard or FortiAnalyzer dashboard display current sessions, bandwidth usage, blocked threats, and system health. They use thresholds to trigger alerts — for example, if the CPU on a FortiGate hits 90%, an alert pops up. Monitoring does not store long-term data; it fades away like a live broadcast. Its purpose is to give you immediate awareness so you can respond to a problem as it occurs.

Reporting is the weekly or monthly summary that turns logs into trends. While logs contain every raw event and monitoring shows the moment, reporting aggregates data over time to answer questions like: How many malware attacks did we block last month? Which department downloaded the most unauthorised applications? Reports in Fortinet environments are generated by FortiAnalyzer or FortiCloud, and they can be scheduled (daily, weekly, monthly) or run on demand. Reports are used for compliance (proving to auditors that you meet security standards), for security analysis (spotting a slow-brewing attack), and for capacity planning (realising you need more bandwidth because traffic keeps increasing).

Now, why do these three matter together? Because they form a cycle. Logging creates the data. Monitoring lets you react in the moment. Reporting lets you learn and improve. In the NSE7 exam, you must understand how to configure the log settings on a FortiGate (log to local disk, to FortiAnalyzer, or to syslog), how to interpret log severity levels (emergency, alert, critical, error, warning, notice, informational, debug), and how to generate reports that meet organisational needs.

Logs themselves have types:
- Traffic logs record every network connection: who talked to whom, how much data moved, and which security policy allowed it.
- Event logs record system events like admin logins, configuration changes, and system reboots.
- Security logs record what the security features did: blocked intrusions, detected viruses, and prevented attacks.

Log severity levels range from 0 (emergency) to 7 (debug). For the exam, you need to know that if a system is unusable, the log will be severity 0 emergency. Most day-to-day operational logs are severity 5 notice or severity 6 informational.

FortiAnalyzer is the central tool for logging and reporting in Fortinet environments. It can receive logs from FortiGates, FortiSwitches, FortiAPs, and even third-party devices via syslog. FortiAnalyzer then indexes the logs, making them searchable, and runs report templates that you can customise. The exam will test you on configuring FortiAnalyzer as a log collector, setting up log shipping from a FortiGate, and scheduling report generation.

Another key concept is syslog — a standard protocol for sending log messages across a network. FortiGate can send logs to any syslog server, but the exam focuses on FortiAnalyzer integration because that is what Fortinet recommends for full functionality.

Finally, understand that logging and monitoring have a cost. Every log consumes disk space, network bandwidth, and processing power. If you log everything at debug level, your FortiGate will slow down and fill storage quickly. In real life, you log at appropriate levels: informational for traffic logs, warning for security logs, and only enable debug during troubleshooting. The exam will present scenarios where you must choose the correct log level or the right storage destination.

## Real-world context

Imagine you are the IT administrator for a mid-sized company called ‘BrightCloud’, which has two branch offices, a main headquarters, and 500 employees. Your CEO just received a nasty email from a client claiming their data was stolen. You need to prove whether a breach occurred and, if so, how it happened. Here is exactly what you do.

Step 1: Check the live monitoring dashboard. You log into your FortiGate (the firewall at HQ) and look at the real-time dashboard. You see current sessions — a few thousand, which is normal for the middle of the week. No spikes. No blocked traffic spikes. The CPU and memory are fine. The monitoring gives you an immediate sense: nothing weird is happening right now.

Step 2: Query historical logs. You open FortiAnalyzer and search for all traffic logs from the client’s IP range over the past week. You filter the logs to show only events with severity ‘error’ or ‘critical’. You find three logs: an intrusion prevention system (IPS) alert that blocked a known malware signature from the client’s IP at 2:34 AM on Tuesday, a virus detection on an email attachment from the same IP at 3:12 AM, and a successful VPN login from the client’s IP at 3:30 AM. That is suspicious — the attacker used a valid VPN credential to get inside.

Step 3: Generate a detailed report. You run a pre-built ‘Security Incident Report’ in FortiAnalyzer for the client’s IP range and the date range. The report includes a timeline of events, the exact bytes transferred, and the username that logged in via VPN. You export the report as a PDF.

Step 4: Correlate with user identity. You check the identity logs and see that the VPN login used the username ‘jdoe@brightcloud.com’. You contact John Doe in accounting and discover he never logs in at 3:30 AM. His password was weak — he used ‘Password123’. The attack was a credential theft followed by lateral movement.

Step 5: Take action. Based on the report, you reset John’s password, enable multi-factor authentication (MFA) on all VPN accounts, and create a new log monitoring rule that triggers an alert if any VPN login occurs outside business hours.

What did you use from logging, monitoring, and reporting?
- Logging: the raw traffic, security, and VPN logs stored on FortiAnalyzer.
- Monitoring: the real-time dashboard that showed nothing was actively wrong.
- Reporting: the PDF report that you handed to your CEO and later to the client as proof of response.

In this real-world scenario, you discovered a breach that happened days ago, but without logs, you would have had no evidence. Without monitoring, you would not have known that the attack was over. Without reporting, you could not have communicated the incident to management in a professional format. That is why every NSE7 security professional must master these three pillars.

## Exam focus

The NSE7 exam objective 6.1 specifically tests your ability to configure logging, monitor security events, and generate reports using FortiGate and FortiAnalyzer. Expect about 8-12 questions on this topic across the exam. They love to test the fine details because logging is easy to neglect but critical in production.

Here are the key exam focus areas with the traps they set:

- Log levels and severity: They will ask which severity level applies to a specific event. Trap: they list a non-existent FortiGate severity like ‘high’ or ‘low’. FortiGate uses 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug. Memorise the numbers and meanings.
- Log destinations: They test whether a FortiGate can send logs to a syslog server (yes), FortiAnalyzer (yes, but requires a valid license), or to cloud-based FortiCloud (yes, with an account). Trap: they say logs can only go to one place. In reality, a FortiGate can send logs to multiple destinations simultaneously using the ‘log setting’ configuration.
- FortiAnalyzer configuration: They will present a scenario where a FortiGate is not sending logs to FortiAnalyzer. The correct answer is often that the FortiAnalyzer is not added as a log destination in the FortiGate’s ‘log setting’, or that the FortiGate’s management IP is not reachable from FortiAnalyzer. They also test that the FortiAnalyzer must have a configurable ‘log retention policy’ — you specify how many days to store logs before deletion.
- Report generation: They love to ask about scheduling reports. The correct answer pattern is: in FortiAnalyzer, go to ‘Report’ > ‘Schedule Report’, choose a template (like ‘Top Threats’ or ‘Traffic Analysis’), set a recurrence (daily/weekly/monthly), and define the output format (PDF, CSV, HTML). Trap: they might say reports are generated automatically without any configuration — false, you must create the schedule.
- Event handlers and alerts: They test the concept of ‘log monitors’ in FortiAnalyzer — rules that trigger actions (like email alerts) when a specific log pattern occurs. Trap: they confuse this with ‘report scheduling’. A log monitor is for real-time alerting; a report schedule is for periodic summaries. Learn the difference.
- Syslog vs FortiAnalyzer: They ask which protocol to use when sending logs to a third-party system. Correct answer: syslog. They ask which is recommended by Fortinet for full features. Correct answer: FortiAnalyzer, because it supports log aggregation, searching, reporting, and event correlation that syslog alone does not.
- Logging overhead: They test the concept that logging at debug level on a busy firewall will degrade performance and fill storage. Trap: they say debug is the default setting — it is not; the default is informational (level 6).
- Compliance reporting: They test that reports can be customised to meet standards like PCI DSS or GDPR. The exam expects you to know that FortiAnalyzer provides pre-built compliance report templates.

Memorise these patterns, and you will answer logging and reporting questions correctly. The exam will frequently use the phrase ‘which of the following is the correct log severity for X’ or ‘what is the primary benefit of using FortiAnalyzer over syslog’. Train yourself to spot the correct answer by recalling the exact definitions and configurations outlined here.

## Step by step

1. **Configure Log Settings on FortiGate** — Access the FortiGate’s ‘Log & Report’ settings. Choose the destination (local disk, FortiAnalyzer, syslog, or FortiCloud). Set the log severity threshold — for traffic logs, informational is standard; for security logs, warning is typical. This step defines where and what level of events are recorded.
2. **Set Up FortiAnalyzer as a Log Collector** — In FortiGate’s ‘Log Setting’ menu, add the FortiAnalyzer IP address and configure the connection (usually on port 514 for syslog or 443 for web). Ensure the FortiAnalyzer device is licensed and has network reachability. This centralises logs from all FortiGates into one searchable database.
3. **Create a Log Monitor (Alert) on FortiAnalyzer** — Within FortiAnalyzer, go to ‘Event Handler’ > ‘Log Monitor’. Define a rule: for example, if a log with severity ‘critical’ or ‘emergency’ appears from any FortiGate, trigger an email alert. This converts raw logs into proactive notifications.
4. **Generate a Scheduled Report** — In FortiAnalyzer, navigate to ‘Report’ > ‘Schedule Report’. Choose a pre-built template (e.g., ‘Top Threats’ or ‘Compliance Report’), set a recurrence (weekly), and define the output format (PDF). This turns logs into readable summaries for management or auditors.
5. **Verify and Test the Logging Pipeline** — Generate a test event — for example, force a blocked web request through a security policy. Check that the log appears in FortiGate’s local logs, then verify it also appears in FortiAnalyzer’s search. Confirm that the log monitor alert email arrives. This step validates that the entire logging chain works end-to-end.
6. **Review and Tune Log Levels** — After a week, review log storage usage on FortiAnalyzer. If storage is 80% full, you may need to reduce the log retention period (e.g., from 90 days to 30 days) or increase the severity threshold for traffic logs. Tuning ensures logging does not become a bottleneck.

## Comparisons

### Logging vs Monitoring

**Logging:**
- Stores historical records of events on disk
- Can be searched and analysed later
- Uses severity levels to filter data

**Monitoring:**
- Provides real-time current state dashboards
- Fades away after the moment passes
- Alerts are based on thresholds, not severity levels

### FortiAnalyzer vs Syslog Server

**FortiAnalyzer:**
- Fortinet proprietary, requires a license
- Supports log search, correlation, and reporting
- Can generate customised scheduled reports

**Syslog Server:**
- Standard open protocol, works with any vendor
- Basic log storage with limited search capability
- Does not generate reports natively

### Traffic Log vs Security Log

**Traffic Log:**
- Records every allowed or denied connection
- Includes source/destination IP and port
- Used for capacity planning and audits

**Security Log:**
- Records blocked attacks and intrusions
- Includes virus names and threat IDs
- Used for incident response and forensics

### Log Severity 'Informational' (6) vs Log Severity 'Debug' (7)

**Log Severity 'Informational' (6):**
- Default level for traffic logging
- Captures enough detail for normal operations
- Consumes moderate storage

**Log Severity 'Debug' (7):**
- Captures every step of a process
- Used only during troubleshooting
- Can fill storage rapidly and degrade performance

## Diagram

_Flowchart showing how logs travel from a FortiGate firewall to different destinations, with FortiAnalyzer enabling search, alerts, and reports._

```mermaid
flowchart TD
    A[FortiGate Firewall] -->|Logs sent| B[Local Storage]
    A -->|Logs sent via syslog| C[Third-party Syslog Server]
    A -->|Logs sent via HTTPS| D[FortiAnalyzer]
    D --> E[Log Search]
    D --> F[Log Monitor Alerts]
    D --> G[Scheduled Reports]
    G --> H[PDF Report for Management]
```

## Common misconceptions

- **Misconception:** Logs store only security events like attacks, not normal traffic **Reality:** Logs record all events at the configured severity level, including normal traffic, admin activity, and system health (People often think logs are only for ‘bad stuff’ because they associate logging with security. But traffic logs that show normal connections are equally important for capacity planning and anomaly detection.)
- **Misconception:** Monitoring and reporting are the same thing — both give you data **Reality:** Monitoring provides real-time awareness of current events; reporting provides historical summaries over a period (The distinction is easy to blur because both involve dashboards and alerts. But the exam specifically tests the difference: monitoring fades away, reporting persists.)
- **Misconception:** Logging all events at debug level gives the best security because nothing is missed **Reality:** Logging at debug level degrades firewall performance and fills storage quickly, making it impractical for production (New administrators think more data is always better. They do not understand the trade-off between visibility and system performance.)
- **Misconception:** A FortiGate can only send logs to one destination at a time **Reality:** A FortiGate can send logs to multiple destinations concurrently, such as local disk, FortiAnalyzer, and syslog server (This misconception stems from simpler devices that only log locally. FortiGate’s log settings allow multiple destinations via the ‘log setting’ CLI or GUI.)
- **Misconception:** If I enable logging on a policy, all traffic through that policy will be logged at the same severity for every session **Reality:** You can configure different log types (traffic, security, event) independently, and can set the severity within each log type (People think logging is a simple on/off switch. In reality, you can granularly set what to log per policy per log type.)

## Key takeaways

- Logging creates a permanent record of network events; monitoring gives you real-time awareness; reporting summarises historical data for analysis.
- FortiGate logs are classified into four types: traffic, event, security, and system logs — each serves a distinct purpose.
- Log severity levels range from 0 (emergency) to 7 (debug) — memorise them for the exam.
- FortiGate can send logs to multiple destinations: local disk, FortiAnalyzer, syslog server, and FortiCloud simultaneously.
- FortiAnalyzer is the central log collector and report generator for Fortinet environments — it aggregates logs from multiple devices and enables search and correlation.
- Reports are not automatic — you must configure a schedule and select a template in FortiAnalyzer.
- Syslog is a standard protocol for sending logs to third-party systems; FortiAnalyzer is recommended for full functionality.
- Enabling debug-level logging on a busy firewall will degrade performance and consume excessive storage — only use it for troubleshooting.

## FAQ

**What is the difference between syslog and FortiAnalyzer?**

Syslog is a standard protocol for sending log messages to any server. FortiAnalyzer is Fortinet’s dedicated log management and reporting appliance that offers advanced features like search, correlation, and scheduled reports which syslog alone does not provide.

**Can I send FortiGate logs to multiple places at once?**

Yes. FortiGate supports sending logs to multiple destinations simultaneously, such as local disk, FortiAnalyzer, syslog server, and FortiCloud, all configured under the log settings.

**What log severity level should I use for normal traffic logging?**

For normal traffic logging, use severity 6 (informational). This records connection details without filling storage with debug-level noise.

**How do I generate a report on FortiAnalyzer?**

Go to FortiAnalyzer’s ‘Report’ menu, select a template (like ‘Security Incidents’ or ‘Top Threats’), set a schedule (daily/weekly/monthly), choose output format (PDF, CSV, HTML), and run or schedule the report.

**What happens if I set log severity to debug on a busy FortiGate?**

The FortiGate will log every single event, including routine debug messages. This consumes huge storage and CPU resources, slowing down the firewall and potentially filling the disk within hours. Use debug only during active troubleshooting.

**Do I need a license to send logs from FortiGate to FortiAnalyzer?**

Yes. The FortiAnalyzer device requires a valid license to receive and store logs. Without a license, it will not accept logs from FortiGates.

## Check your understanding

1. **What is the primary purpose of a log monitor in FortiAnalyzer?**

   Answer: A log monitor triggers real-time alerts (e.g., email) when a specific log pattern occurs, providing immediate notification of critical events.

2. **What log severity level corresponds to a system that is unusable?**

   Answer: Severity 0 (emergency) corresponds to a system that is unusable, indicating a complete failure.

3. **Can FortiGate send logs to FortiAnalyzer and a syslog server at the same time?**

   Answer: Yes, FortiGate supports sending logs to multiple destinations concurrently through the log settings configuration.

4. **What is the difference between a traffic log and a security log?**

   Answer: A traffic log records all network connections (allowed or denied), while a security log records actions taken by security features like antivirus or intrusion prevention.

5. **Why should you avoid using debug-level logging in production?**

   Answer: Debug-level logging generates massive amounts of data, which degrades firewall performance and quickly fills storage, making it unsuitable for production environments.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse7/logging-monitoring-and-reporting