Technical Tip: Display last SSL user login via CLI

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 246821

Description

This article describes how to view a user's last login via CLI.

Scope

Fortigate, FortiOS 7.0.x, and 7.2.x.

Solution

Configure the following filter via CLI:

execute log filter reset
execute log filter category 1
execute log filter field user <Username> <- User to query.
execute log filter view-lines 100

Run the following command to display logs:

execute log display

Output example:

1: date=2022-12-05 time=09:51:01 eventtime=1670262661379246260 tz="-0800" logid="0101039424" type="event" subtype="vpn" level="information" vd="root" logdesc="SSL VPN tunnel up" action="tunnel-up" tunneltype="ssl-web" tunnelid=260552120 remip=192.168.13.10 user="<Username>" group="ssl_vpn_users" dst_host="N/A" reason="login successfully" msg="SSL tunnel established"

2050

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.