Log: fortigate-ips-log4j
date=2026-08-11 time=19:00:59 devname="FORTI-FW-FGT" devid="FGVMEV0000000000" eventtime=1786464058271596855 tz="+0300" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="critical" srcip=203.0.113.77 srccountry="United States" dstip=10.22.2.4 srcintf="port1" dstintf="port2" policyid=1 sessionid=65244501 action="dropped" proto=6 service="HTTP" attack="Apache.Log4j.Error.Log.Remote.Code.Execution" srcport=51222 dstport=80 direction="incoming" attackid=51006 profile="default" ref="http://www.fortinet.com/ids/VID51006" incidentserialno=123456789 msg="applications3: Apache.Log4j.Error.Log.Remote.Code.Execution"
For: Fortinet FortiGate firewall (UTM / IPS)
Meaning: The FortiGate IPS engine matched a signature and stopped the request. Reading the fields that matter:
type=utm subtype=ips means this came from the intrusion prevention engine rather than ordinary traffic logging,
action=dropped means the packet did not reach your server, and
direction=incoming means someone on the internet was probing you rather than one of your own machines reaching out.
The
attack field names the signature: Apache Log4j remote code execution, better known as Log4Shell. The source 203.0.113.77 tried it against 10.22.2.4 on port 80.
level=alert and
severity=critical are FortiGate's own ratings, and on this one they are earned.
What to do: Nothing to do about this specific packet, since it was dropped. What matters is the pattern: a single Log4j probe is background noise on the internet, but the same source trying repeatedly, or a variety of exploits from one network, is worth blocking at the edge. Confirm the targeted host is actually patched, because the next attempt may arrive by a route your firewall does not inspect.
Get
Started