Syslog Fortinet FortiGate - V 2.0 : UTM : VOIP

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/986892/sample-logs-by-log-type

V 2.0: UTM: VOIP

Base Rule

General Firewall Event

Information

V 2.0: Voip SIP

Sub Rule

VoIP SIP Message

Information

V 2.0: LOGID_EVENT_VOIP_SIP_BLOCK

Sub Rule

Access Blocked

Information

V 2.0: LOGID_EVENT_VOIP_SIP_FUZZING

Sub Rule

Session Stopped

Other Audit Success

V 2.0: LOGID_EVENT_VOIP_SCCP_REGISTER

Sub Rule

Device Registered

Other Audit Success

V 2.0: LOGID_EVENT_VOIP_SCCP_UNREGISTER

Sub Rule

Device Unregistered

Warning

V 2.0: LOGID_EVENT_VOIP_SCCP_CALL_BLOCK

Sub Rule

VoIP SCCP Call Block Message

Information

V 2.0: LOGID_EVENT_VOIP_SCCP_CALL_INFO

Sub Rule

VoIP SCCP Call Block Message

Information

logver

<version>

Number

N/A

timestamp

N/A

N/A

N/A

devname

<sname>

Text/String

N/A

devid

N/A

N/A

N/A

vd

<sessiontype>

Text/String

N/A

date

N/A

N/A

The date of the event.

time

N/A

N/A

The time of the event.

eventtime

N/A

N/A

N/A

tz

N/A

N/A

N/A

logid

<vmid>

Number

The log ID.

type

<vendorinfo>

Text/String

The type of event.

subtype

N/A

N/A

The subtype of the event.

eventtype

N/A

N/A

The specific type of VOIP event.

level

<severity>

Text/String

The level of the event.

session_id

<session>

Number

The ID of the session associated with the log event.

epoch

N/A

N/A

N/A

event_id

N/A

N/A

N/A

srcip

<sip>

IP Address

The source IP address.

src_port

<sport>

Number

The source port.

dstip

<dip>

IP Address

The destination IP address.

dst_port

<dport>

Number

The destination port.

proto

<protnum>

Number

The protocol.

src_int

N/A

N/A

The source interface.

dst_int

N/A

N/A

The destination interface.

policy_id

<policy>

Number

The policy ID.

profile

N/A

N/A

N/A

voip_proto

<protname>

Text/String

N/A

kind

N/A

N/A

N/A

action

<action>

Text/String

N/A

status

<status>

Text/String

N/A

duration

<seconds>

Number

N/A

dir

N/A

N/A

N/A

call_id

N/A

N/A

N/A

from

<sender>

Text/String

N/A

to

<recipient>

Text/String

N/A

logsrc

N/A

N/A

N/A