Fortinet black logo

Handbook

Configuring syslog settings

Configuring syslog settings

A remote syslog server is a system provisioned specifically to collect logs for long term storage and analysis with preferred analytic tools.

Before you begin:

  • You must have Read-Write permission for Log & Report settings.
To configure syslog settings:
  1. Go to Log & Report > Log Setting.
  2. Click the Syslog Server tab.
  3. Click Create New to display the configuration editor.
  4. Complete the configuration as described in Syslog configuration.
  5. Save the configuration.

Syslog configuration

Settings Guidelines
Status Select to enable the configuration.
Address IP address of the syslog server.
Port Listening port number of the syslog server. Usually this is UDP port 514.
Log Level Select the lowest severity to log from the following choices:
  • Emergency—The system has become unstable.
  • Alert—Immediate action is required.
  • Critical—Functionality is affected.
  • Error—An error condition exists and functionality could be affected.
  • Warning—Functionality might be affected.
  • Notification—Information about normal events.
  • Information—General information about system operations.
  • Debug—Detailed information about the system that can be used to troubleshoot unexpected behavior.

For example, if you select Error, the system sends the syslog server logs with level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with level Alert and Emergency.
CSV Send logs in CSV format. Do not use with FortiAnalyzer.
Facility Identifier that is not used by any other device on your network when sending logs to FortiAnalyzer/syslog.
Event Select to enable logging for events.
Event Category Select the types of events to send to the syslog server:

  • Configuration—Configuration changes.
  • Admin—Administrator actions.
  • System—System operations, warnings, and errors.
  • User—Authentication results logs.
  • Health Check—Health check results and client certificate validation check results.
  • SLB—Notifications, such as connection limit reached.
  • LLB—Notifications, such as bandwidth thresholds reached.
  • GLB—Notifications, such as the status of associated local SLB and virtual servers.
  • Firewall—Notifications for the "firewall" module, such as SNAT source IP pool is using all of its addresses.
Traffic Select to enable logging for traffic processed by the load balancing modules.
Traffic Category
  • SLB—Server Load Balancing traffic logs related to sessions and throughput.
  • GLB—Global Load Balancing traffic logs related to DNS requests.
  • LLB—Link Load Balancing traffic logs related to session and throughput
Security Select to enable logging for traffic processed by the security modules.
Security Category
  • DoS—SYN flood protection logs.
  • IP Reputation—IP Reputation logs.
  • WAF—WAF logs.
  • GEO—Geo IP blocking logs.
  • AV—AV logs
  • IPS—IPS logs
  • FW—Firewall logs
Script Select to enable scripting.
Script Category SLB is elected by default.

Configuring syslog settings

A remote syslog server is a system provisioned specifically to collect logs for long term storage and analysis with preferred analytic tools.

Before you begin:

  • You must have Read-Write permission for Log & Report settings.
To configure syslog settings:
  1. Go to Log & Report > Log Setting.
  2. Click the Syslog Server tab.
  3. Click Create New to display the configuration editor.
  4. Complete the configuration as described in Syslog configuration.
  5. Save the configuration.

Syslog configuration

Settings Guidelines
Status Select to enable the configuration.
Address IP address of the syslog server.
Port Listening port number of the syslog server. Usually this is UDP port 514.
Log Level Select the lowest severity to log from the following choices:
  • Emergency—The system has become unstable.
  • Alert—Immediate action is required.
  • Critical—Functionality is affected.
  • Error—An error condition exists and functionality could be affected.
  • Warning—Functionality might be affected.
  • Notification—Information about normal events.
  • Information—General information about system operations.
  • Debug—Detailed information about the system that can be used to troubleshoot unexpected behavior.

For example, if you select Error, the system sends the syslog server logs with level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with level Alert and Emergency.
CSV Send logs in CSV format. Do not use with FortiAnalyzer.
Facility Identifier that is not used by any other device on your network when sending logs to FortiAnalyzer/syslog.
Event Select to enable logging for events.
Event Category Select the types of events to send to the syslog server:

  • Configuration—Configuration changes.
  • Admin—Administrator actions.
  • System—System operations, warnings, and errors.
  • User—Authentication results logs.
  • Health Check—Health check results and client certificate validation check results.
  • SLB—Notifications, such as connection limit reached.
  • LLB—Notifications, such as bandwidth thresholds reached.
  • GLB—Notifications, such as the status of associated local SLB and virtual servers.
  • Firewall—Notifications for the "firewall" module, such as SNAT source IP pool is using all of its addresses.
Traffic Select to enable logging for traffic processed by the load balancing modules.
Traffic Category
  • SLB—Server Load Balancing traffic logs related to sessions and throughput.
  • GLB—Global Load Balancing traffic logs related to DNS requests.
  • LLB—Link Load Balancing traffic logs related to session and throughput
Security Select to enable logging for traffic processed by the security modules.
Security Category
  • DoS—SYN flood protection logs.
  • IP Reputation—IP Reputation logs.
  • WAF—WAF logs.
  • GEO—Geo IP blocking logs.
  • AV—AV logs
  • IPS—IPS logs
  • FW—Firewall logs
Script Select to enable scripting.
Script Category SLB is elected by default.