Description
This article provides some details about which event log is triggering the 'Configuration Change' event found in automation stitch.
Useful links:
Fortinet Documentation
Automation stitches: https://docs.fortinet.com/document/fortigate/6.0.6/handbook/712138/automation-stitches
Solution
The stitch is triggered by the event that is created when an admin made configuration changes to the FortiGate and logs out of the device.
The log id that triggers this stitch is 0100032102.
Events with this ID can be found by applying a filter with Log ID 0100032102 under Events in Log & Reports section of the FortiGate.
Testing the stitch will trigger an event with the same logid.
Message:
'Configuration is changed in the admin session'
'Automation Stitch Test: Configuration is changed in the admin session'
