Troubleshooting Tip: FQDN Syslog is not working after the v7.4.8 upgrade

As of version 7.4.8, FortiGate does not cache FQDNs when the DNS A record has a TTL (Time To Live) of 0.
As a result, syslog does not function as expected when the syslog server is configured using an FQDN.

Since no cache entry exists, FortiGate should send a DNS query for the syslog server FQDN each time before sending syslog when the TTL is 0.
However, FortiGate does not send the DNS query, which is considered a bug.

To resolve the issue of FQDN syslog not working after upgrading to FortiGate v7.4.8, follow these steps:

1. Check the DNS response for the FQDN and verify that the DNS A record TTL is set to 0 by running the command execute ping docker.lab.com.

If the TTL is verified to be 0, the FortiGate will not cache the resolved IP address and will not even send a syslog-related FQDN DNS query, and this behavior is confirmed as a bug.

config log syslogd setting
    set status enable
    set server "docker.lab.com"
    set mode udp
    set port 514
    set facility local7
    set source-ip ''
    set format cef
    set priority default
    set max-log-rate 0
    set interface-select-method auto
end

2. Verify that the FortiGate is configured to send syslog messages to the correct FQDN.

    

3. Try setting the IP address instead of the FQDN in the syslog configuration or the A DNS TTL to anything other than 0.

    

It is also important to note that a DNS TTL value of 0 is not recommended, as it can cause increased DNS traffic and higher server load. For a logging server, this can result in each log delivery triggering a DNS query to the DNS server, which can cause performance issues and unreliability.

Note: This issue has been fixed in FortiGate v8.0.0.