Fortigate not showing Deny logs

[sozo]

Howdy all,

I am trying to view Deny traffic logs on a Fortigate 30E
(FortiGate 30Ev6.2.15 build1378 (GA)
and they are not showing up.
Via the CLI - log severity level set to Warning
Local logging

Here is the details:
CMB-FL01 # show full-configuration log memory filter
config log memory filter
set severity warning
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set filter ‘’
set filter-type include

The Fortigate is getting hammered, with alerts coming in thusly: (Sanitized)

Message meets Alert condition
date=2024-11-14 time=15:04:05 devname=CMB-FL01 devid=FGT30E5777885133 logid=“0000000013” type=“traffic” subtype=“forward” level=“notice” vd=“root” eventtime=1731621845329636171 tz=“-0700” srcip=194.264.22.254 srcport=56676 srcintf=“wan” srcintfrole=“wan” dstip=93.22.3.19 dstport=10443 dstintf=“lan” dstintfrole=“lan” sessionid=3808968 proto=6 action=“deny” policyid=0 policytype=“policy” service=“tcp/10443” dstcountry=“Canada” srccountry=“Canada” trandisp=“dnat” tranip=195.137.0.254 tranport=443 duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat=“unscanned” crscore=30 craction=131072 crlevel=“high”

Implicit Deny policy in place - set to log violation Traffic:

However I can find no deny logs:

Nor can I see the Implicit Deny object when trying to search logs by Policy:

I don’t know if I am missing something obvious, or have configured something incorrectly.
If anyone has any advice it would be appreciated!
Thanks to any takers.
Sozo

[matt7863 (m@ttshaw)]

Check there are no explicit deny rules with no log action.

If the log is not showing deny then where do you view that alert you posted - that was a deny.

[sozo]

Hi m@ttshaw,
No deny rules with no log action.
The Alert comes from the appliance directly, we have it set to both email us the violation and log it.
While it is emailing us, it isn’t logging it as well.
We have come to the conclusion that the appliance is malfunctioning in this regard as it should be logging and isnt. Thanks for youir time.
Best,
Sozo