Log database and datasets

The log database, also known as the SQL log database, is used to store logs on FortiGate units that have a builtin hard disk. The log database uses Structured Query Lanaguage (SQL), specifically it uses SQLite which is an embedded Relational Database Management System (RDBMS).

If you have disabled SQL logging and have factory defaults on the FortiGate unit, and then you upgrade the firmware, the upgrade will automatically disable SQL logging. When this occurs, you must re-enable SQL logging manually.

The FortiGate unit creates a database table for each log type, when log data is recorded. If the FortiGate unit is not recording log data, it does not create log tables for that device.

If you want to view the size of the database, as well as the log database table entries, use the get report sqlstatus command. This command displays the amount of free space that is available as well as the first and last log database entry time and date.

The output of the get report sql status command contains information similar to the following:

Database size: 294912

Free size in database: 0 Database Page Size: 8192 Entry number:

Event: 49

Traffic: 370

Attack: 2

AntiVirus: 4

WebFilter: 254

AntiSpam: 2

Netscan: 18

Total: 699

First entry time: 2012-09-10 11:41:02

Last entry time: 2012-09-13 02:59:59

The log database is not only used to store logs, but also used to extract the information for reports. Reports are built from datasets, which are SQL statements that tell the FortiGate unit how to extract the information from the database. You can create your own datasets; however, SQL knowledge is required. Default datasets are available for reports.