NSE4 · Question #81
Regarding the header and body sections in raw log messages, which statement is correct?
The correct answer is B. The header section layout is always the same regardless of the log type. The body section layout. In FortiGate raw log messages, the header section maintains a consistent layout across all log types, while the body section's layout is variable, adapting to the specific log content.
Question
Regarding the header and body sections in raw log messages, which statement is correct?
Options
- AThe header and body section layouts change depending on the log type.
- BThe header section layout is always the same regardless of the log type. The body section layout
- CSome log types include multiple body sections.
- DSome log types do not include a body section.
How the community answered
(55 responses)- A2% (1)
- B95% (52)
- C2% (1)
- D2% (1)
Why each option
In FortiGate raw log messages, the header section maintains a consistent layout across all log types, while the body section's layout is variable, adapting to the specific log content.
This is incorrect because the header layout is consistent, not variable.
FortiGate log messages are structured with a consistent header that provides general information like timestamp and device ID, ensuring uniform parsing for basic log identification. The body section, however, contains detailed event-specific information, and its fields and format dynamically adjust to reflect the unique data pertinent to the particular log type (e.g., traffic, event, virus logs).
Log messages typically have a single body section containing event-specific details, not multiple distinct body sections.
All standard FortiGate log types include a body section to convey the specific details of the event being logged.
Concept tested: FortiGate log message structure
Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-log-message-reference/263539/log-message-format
Topics
Community Discussion
No community discussion yet for this question.