Getting VPN logs

[rgacz]

Is there a way to get VPN logs using PowerFGT?
There is a command Get-FGTLogTraffic to get traffic logs, I haven't found a command to get system events (e.g. VPN) logs.
I can use Rest API, but then I don't know about a way how to show older logs.
If I use
(Invoke-FGTRestMethod -method "get" -uri "api/v2/log/disk/event/vpn" -filter "logid==0101039947,logid==0101039948,logid==0107045124,logid==0107045125").results
I get logs for short period only. I want to get older logs. How can I do this?
When using GUI, I can see FortiGate has these logs.

[alagoutte]

Hi @rgacz

No yet ! for time, you can look LogTraffic metadata_timestamp... => https://github.com/FortiPower/PowerFGT/blob/master/PowerFGT/Public/log/traffic.ps1#L187

But yes, i can be a good idea to add Get-FGTLogEvent

[alagoutte]

What do you have when use -verbose ?
may need to use -verbose

-filter is not the same like filter on Web GUI ;-)

[rgacz]

(Invoke-FGTRestMethod -method "get" -uri "api/v2/log/disk/event/vpn" -filter '_metadata.timestamp>=1738368000000,_metadata.timestamp<1740787199000' -Verbose).results
VERBOSE: https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=_metadata.timestamp>=1738368000000,_metadata.timestamp<1740787199000
VERBOSE: GET https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=_metadata.timestamp>=1738368000000,_metadata.timestamp<1740787199000 with 0-byte payload
VERBOSE: received 286428-byte response of content type application/json

Is this OK? When I see Fortinet examples, they show URLs like
...&filter=_metadata.timestamp%3E=%221738368000000%22&filter=_metadata.timestamp%3C=%221740787199000%22...
(parameter filter used more times).

And Extra parameter seems to add it without delimiter:

(Invoke-FGTRestMethod -method "get" -uri "api/v2/log/disk/event/vpn" -filter 'user=@"*username*"' -extra 'rows=9999' -Verbose)
VERBOSE: https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=user=@"*username*"rows=9999
VERBOSE: GET https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=user=@"*username*"rows=9999 with 0-byte payload
VERBOSE: received 369-byte response of content type application/json

Adding comma does not help:

(Invoke-FGTRestMethod -method "get" -uri "api/v2/log/disk/event/vpn" -filter 'user=@"*username*"' -extra ',rows=9999' -Verbose)
VERBOSE: https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=user=@"*username*",rows=9999
VERBOSE: GET https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=user=@"*username*",rows=9999 with 0-byte payload
VERBOSE: received 369-byte response of content type application/json

rows: 400
total_lines: 0

[alagoutte]

for rows, you need to use &rows=XXX
and may need to escape some caracter ?

do you have try to display all look (like since 1d) and after filter the result ? (i'm use this solution)

[rgacz]

-extra "&rows=9999" works. Thanks.
But it does not help for the result:

(Invoke-FGTRestMethod -method "get" -uri "api/v2/log/disk/event/vpn" -filter 'subtype=*"vpn",user=@"*username*",_metadata.timestamp<"1740787200000"' -Verbose).results | ft
VERBOSE: https://fqdn10443/api/v2/log/disk/event/vpn?&filter=subtype=*"vpn",user=@"*username*",_metadata.timestamp<"1740787200000"
VERBOSE: GET https://fqdn:10443/api/v2/log/disk/event/vpn?&filter=subtype=*"vpn",user=@"*username*",_metadata.timestamp<"1740787200000" with 0-byte payload
VERBOSE: received 276815-byte response of content type application/json

It list other subtype recoreds, not only vpn.
It list other users, not only username.
And it shows latest 400 rows, not rows older 2025-03-01 (1740787200000).

I have to admit it behaves very strange or I do not understand the logic.

[alagoutte]

I start to add Get-FGTLogEvent but i get some issue for the moment (get wrong log...)