IPsec tunnels Logs Not Consistently Forwarded to FortiSIEM

Forum|Forum|2 months ago
June 14, 2026
2 replies
84 views

Hi,
I want to create a correlation rule in FORTISIEM that detects when a VPN tunnel goes down and is not followed by a corresponding tunnel-up event within a defined time window.

I have a FortiGate acting as a dial-up IPsec VPN hub for remote devices with forticlient(with auto reconnect) to be always connected 24/7.

some peers generate tunnel-up events that successfully reach FortiSIEM, while other peers generate tunnel-up events locally on the FortiGate but those events never appear in FortiSIEM even though the tunnel is successfully re-established.

Tunnel-down events are received consistently.

Logging level is configured to "All" and I can see tunnel-up/tunnel-down events locally on the FortiGate.

Has anyone experienced forwarding of IPsec tunnel-up events or know of any FortiGate logging behavior that could explain this?

Thanks.

AEK

SuperUser

Hi Saif

Which FortiOS version?
Do you see the related tunnel-up messages locally on FG logs?
In case you are using UDP syslog, try using TCP syslog and see if it helps

AEK

S

saif51Author

Explorer

Hi AEK,

Thank you for your response.

FortiOS Version: v7.4.5
Local Logs: Yes, the tunnel-up messages are clearly visible locally in the FortiGate VPN Event logs.
Syslog Protocol: I switched from UDP to TCP syslog, but we are still missing certain logs on the fortisiem

Since the logs exist locally but fail to arrive via TCP, it looks like a selective forwarding or buffering issue. Could you help me check if there are specific log filters or reliable logging queues we need to adjust in v7.4.5?

Best regards,

Sign up

Login with SSO

Login to the community

Login with SSO