Skip to main content
athirat
Staff
Staff
June 25, 2024

Technical Tip: How to prevent syslog logging of local fgfm connection related events from FortiManager

  • June 25, 2024
  • 0 replies
  • 463 views
Description

This article describes how to prevent the sending of 'subtype=fgfm' logs from FortiManager to the syslog server.

Scope FortiManager.
Solution

By default, the below logs highlighting fgfm connection changes between FortiManager and managed devices are sent to the syslog server.

 

date=2023-07-26 time=09:11:12 devname=fortimanager-PROD device_id=FMG-VMTM26001511 log_id=0002011003 type=event subtype=fgfm pri=warning desc="fgfm connection down" msg="fgfm connection to device FGT-LAB-01 is down" user="fgfm" device="FGT-LAB-01"

date=2023-07-26 time=09:09:12 devname=fortimanager-PROD device_id=FMG-VMTM26001511 log_id=0002011003 type=event subtype=fgfm pri=warning desc="fgfm connection up" msg="fgfm connection to device FGT-LAB-01 is up" user="fgfm" device="FGT-LAB-01"

 

On FortiManager, it is possible to disable the fgfm logging to syslog servers as below :

 

config sys locallog syslogd filter
    set fgfm disable 
end

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!