Log: fortigate-admin-login-failed
date=2026-08-11 time=11:14:07 devname="FORTI-FW-FGT" devid="FGVMEV0000000000" eventtime=1786437247119203311 tz="+0300" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="ssh(203.0.113.44)" method="ssh" srcip=203.0.113.44 dstip=198.51.100.10 action="login" status="failed" reason="name_invalid" msg="Administrator admin login failed from ssh(203.0.113.44) because of invalid user name"
For: Fortinet FortiGate firewall (admin access)
Meaning: Somebody tried to log in to the firewall itself and failed.
method=ssh and the source address show this arrived over SSH from the internet, and
reason=name_invalid means the account does not exist.
That reason matters. A wrong password against a real account is usually an administrator fumbling. An attempt against an account that does not exist is somebody finding out which accounts do, which is the first step of a brute force rather than a mistake.
What to do: Management interfaces should not be reachable from the internet at all. Restrict administrative access to a management network or a VPN, and if the interface must be exposed, restrict it to known source addresses. Alert on repeated failures so a slow, quiet attempt does not go unnoticed for weeks.
Get
Started