Technical Tip: How to send Syslog from Linux (Ubuntu) based to FortiAnalyzer

The Ubuntu workstation needs to have the EMS/FortiClient installed on the workstation.

Configure FortiAnalyzer at the EMS system settings. From the FortiAnalyzer side, two authorization devices will pop up at Device Manager: (enable ADOM):

1. EMS.
2. Syslog.

To ensure Ubuntu sends logs to FortiAnalyzer, it is possible to enable the configuration-based guide below:

Log in as root:

login as: root
root@10.47.4.XX's password:

Access to/etc folder:

root@preve-kvm39:~# cd /etc

Edit rsyslog.conf file (syslog config):

root@preve-kvm39:/etc# vi rsyslog.conf

Add FortiAnalyzer info:

# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

*.*@10.47.5.XX:514 #For UDP

The following sniffer can be used to verify that traffic is reaching the FortiAnalyzer :

FortiAnalyzer# diagnose sniffer packet any ' host 10.10.10.10 ' 3 0 l   <----- 10.10.10.10 is the Linux server IP.

Follow the steps below in the screenshot to collect the packets from the GUI to see the packets in PCAP format:

After selecting OK, select the Play button to start the packet capture, then download it using the Download button:

Refresh the FortiAnalyzer, and it will show the event log of Ubuntu.