Log
View
The first packet of session
{IP
‐
5
‐
TUPLE}
matching a Auto Routing rule triggers the log. System generates only
one log for this session. This log indicates packets of the session
{IP
‐
5
‐
TUPLE}
are transferred outward through
WAN link
<widx>
, or all the WAN links defined in the routing and fail-over policies fail to transfer the packets
(
AR=NONE
). The first packet size of the session is
<pktlen>
. See "
" for further information.
PR {IP
‐
5
‐
TUPLE} PR=[<widx>|WAIT_AR|NONE] TOTLEN=<pktlen>
The first packet of session
{IP
‐
5
‐
TUPLE}
matching a Persistent Routing rule triggers the log. System generates
only one log for this session. This log indicates packets of the session
{IP
‐
5
‐
TUPLE}
are transferred outward
through WAN link
<widx>
(the persistence entry of the session is not expired), or Auto Routing determines the
WAN link for the session (PR=WAIT_AR, the persistence entry of the session is expired or absent), or the action to
this session is No PR (PR=NONE). The first packet size of the session is
<pktlen>
. See "
" for
further information.
If a PR log that PR=WAIT_AR, the PR log and a correspondent AR log are generated in pairs.
Virtual Server
VS {IP
‐
5
‐
TUPLE} NEW_DST={ADDR} TOTLEN=<pktlen>
The first packet of session
{IP
‐
5
‐
TUPLE}
matching a Virtual Server rule triggers the log. System generates only
one log for this session. This log indicates destination addresses of the packets of
{IP
‐
5
‐
TUPLE}
are translated to
the new address
{ADDR}
by Virtual Server. The first packet size of the session is
<pktlen>
.
See "
" for further information.
BM
BM {IP
‐
5
‐
TUPLE} INPKTS=<%lu> INBYTES=<%lu> OUTPKTS=<%lu> OUTBYTES=<%lu> TOTALPKTS-
S=<%lu> TOTALBYTES=<%lu> DURATION=<%lu>SECS
Session
{IP
‐
5
‐
TUPLE}
matching a Bandwidth Management filter triggers the log when it is closed. System gen-
erates only one log for this session. This log indicates the traffic statistics (
INPKTS
,
INBYTES
,
OUTPKTS
,
OUTBYTES
,
TOTALPKTS
,
TOTALBYTES
and
DURATION
) of the session
{IP
‐
5
‐
TUPLE}
.
See "
" for further information.
Connection Limit
Count Limit
CL SRC=<ip> DROP=<pkt_number>
This log is triggered every time-period if the number of connections generated by a source
SRC=<ip>
exceeds the
limitation defined in Connection Limit > Count Limit. This log indicates connections generated by
SRC=<ip>
and
passing through FortiWAN are more that the limitation, and there are
<pkt_number>
packets are dropped for the
reason.
258
FortiWAN Handbook
Fortinet Technologies Inc.
