Technical Tip: Configuring FortiAnalyzer log forwarding to use RFC 6587 octet-counting framing

Description

This article describes how to resolve syslog framing mismatches when FortiAnalyzer forwards logs to a third-party syslog/SIEM receiver over TCP. Some syslog receivers strictly parse framing per RFC 6587 and may report framing detection issues (e.g. 'Non-Transparent Framing (CR)') if it is expected octet-counting instead. This article explains the relevant FortiAnalyzer CLI settings and how to switch framing modes.

Scope

FortiAnalyzer.

Solution

Syslog messages sent over TCP are a continuous byte stream with no inherent message boundaries (unlike UDP, where each packet is naturally one message). RFC 6587 defines two ways a TCP syslog stream can indicate where one message ends and the next begins:

1. Octet-Counting (Transparent Framing): RFC 6587 Section 3.4.1. Each message is prefixed with its exact byte length, e.g., 142 <34>1 2026-08-20T. The receiver reads the length, then reads exactly that many bytes as one message.

2. Non-Transparent Framing: RFC 6587 Section 3.4.2. Messages are instead separated by a trailing delimiter character (commonly LF; some implementations use CR or CRLF). The receiver reads until it hits that character.
   
   

This is a separate concern from RFC 5424, which only defines the structure/fields of an individual syslog message (PRI, TIMESTAMP, HOSTNAME, MSG, etc.). A receiver can reject a stream due to framing even if the message content itself is correctly formatted.

Two independent settings under log-forward affect this:

config system log-forward
    edit <id>
        set fwd-syslog-format {fgt | rfc-5424}
        set fwd-syslog-transparent {enable | disable | faz-enrich}
    end
end

Note: It is necessary to configure the set fwd-server-type syslog first.

• fwd-syslog-format: Controls the message content format only (FortiGate native vs RFC 5424). It does not affect framing.

• fwd-syslog-transparent: Controls the framing method between messages:

  • Disable (default): Non-Transparent framing (delimiter-based).

  • Enable: RFC 6587 Octet-Counting (Transparent framing).

  • faz-enrich: Non-Transparent Framing with FortiAnalyzer log enrichment applied.
    
    

If the receiving syslog server expects RFC 6587 octet-counting, enable transparent framing on the FortiAnalyzer log-forward entry:

config system log-forward
    edit <id>
        set fwd-syslog-transparent enable
    end
end

Note: It is necessary to configure the set fwd-server-type syslog first.