Troubleshooting Tip: Multiple Syslog payloads merged into a single payload when FortiGate sends logs to server
| Description | This article explains how to resolve the issue where multiple Syslog payloads from FortiGate were being merged into a single payload when logs were sent to the server. |
| Scope | FortiGate. |
| Solution | When using syslog in reliable mode, FortiGate sends logs over TCP. This can result in multiple payloads being merged when received by some SIEM systems, such as IBM QRadar, especially if the parser is not properly handling message boundaries.
To resolve this behavior, switch the syslog transmission mode from reliable (TCP) to UDP, which sends logs as discrete datagrams and helps the server process them individually. Use the following CLI commands on the FortiGate to change the syslog mode:
After this change, FortiGate will send syslog messages using UDP by default, preventing multiple payloads from merging into a single entry.
Note: Ensure that the receiving system (for example, QRadar) is configured to accept and properly parse syslog over UDP.
For more information about syslog configuration, refer to this KB article: Technical Tip: How to configure syslog on FortiGate. |
