Technical Tip: How to verify if the file is matching the configured file filter profile

[jsarah]

Description	This article describes how to check which profile of the file filter the files matching
Scope	FortiGate v7.
Solution	Run the following command: diagnose sys scanunit debug file-filter enable diag debug enable<----- To start debug, // initiate traffic. diag debug disable<----- To stop debug. scanunit is the daemon responsible for file filters. The example of output will be as follows: file-filter enabled options 0x1 profile FILE_FILTER_TEST_PROFILE  <----- Profile name is FILE_FILTER_TEST_PROFILE . su 24688 job 134 AV engine file info results for 'test.pdf' <----- The file name tried to attach is test.pdf su 24688 job 134 state: 3 ftypeCount: 1 encrypted: 0 need-data: 0 su 24688 job 134 scanunit file-type: -1 : [UNKNOWN] su 24688 job 134 engine file-types: 1 su 24688 job 134 0 => 42 : pdf  <----- Type of the file matched. su 24688 job 134 file_filter match: 'rule1' ft 42 d 0 p 1  <----- 'rule1' is the rule written inside file filter  and 42 means pdf sample configuration example: Example of attachment failure: