Troubleshooting Tip: How to verify if FortiNAC is sending syslogs to external Log Receivers

Description

This article describes how to verify if FortiNAC is sending Syslogs to an external Log Receiver.

Scope

FortiNAC.

Solution

The following is an example of configuration for FortiAnalyzer as a Log Receiver.
The 'Status' column shows as 'empty' instead of 'Connected' and it is necessary to verify whether this communication issue is on the FortiNAC side or on the Syslog receiver's end.

Open two terminals:

1. On the first terminal session, run a packet capture toward the Syslog server on port 514:

execute tcpdump -ni any host <IP_Log_Receiver> and port 514 -v

For example:

fnac-1# execute tcpdump -ni any host 10.191.19.92 and port 514 -v 

2. On the second terminal session, generate a test syslog:

logger -n <IP_Log_Receiver> -P 514 "test"

For example:

fnac-1  # execute enter-shell 
fnac-1:~$ logger -n 10.191.19.92 -P 514 "FortiNAC test"

3. Verify packets are being sent by checking the tcpdump.

4. For further troubleshooting, verify the path from FortiNAC to the Syslog server and make sure packets are not being dropped by the firewalls, then verify if the Syslog server has been configured and the service is enabled.

Related article:

Log receivers