Ubuntu logs
FortiAnalyzer supports normalizing Ubuntu logs as Fabric logs.
|
The Ubuntu Syslog Parser will only parse Ubuntu logs if they are sent from FortiClient. |
The following field mapping applies:
|
Ubuntu Log Field |
Normalized Fabric Log Field |
|---|---|
| devid | data_sourceid |
| data_source_name | data_sourcename |
| data_sourcetype | data_sourcetype |
| data_timestamp | data_timestamp |
| app_name | app_name |
| pid | app_proc |
| service | app_service |
| dst_info | dst_intf |
| event_action | event_action |
| message | event_message |
| log_level | event_severity |
| ext_eventsubtype | event_subtype |
| ext_eventtype | event_type |
| host_classification | host_classification |
| host_hwvendor | host_hwvendor |
| host_hwver | host_hwver |
| host_ip | host_ip |
| host_mac | host_mac |
| hostname,host_name | host_name |
| host_osname | host_osname |
| host_osver | host_osver |
| host_type | host_type |
| host_uid | host_uid |
| ip | src_ip |
| srcmac | src_mac |