Technical Tip: How to directly ingest a syslog file from FortiAnalyzer into FortiSIEM

Description

This article describes how to directly ingest a syslog file downloaded from FortiAnalyzer into FortiSIEM for log ingestion and parser validation.

Scope

FortiSIEM, FortiAnalyzer

Solution

Follow the steps below to ingest the syslog file from FortiAnalyzer into the FortiSIEM Collector:

1. From FortiAnalyzer Log Browse, download the required syslog file from the specific device.

2. When downloading the log, select Text as the Log File Format.

   Note:
   Do not select CSV. The CSV format may not match the original syslog format required by the FortiSIEM parser and may result in the events being displayed as Unknown.

3. From the Raw Event Log, identify the 'reporting_ip' value.

   For example:
   
   

   reporting_ip="10.47.X.X"

   
   Use this IP address as the reporting device IP for the ingestion directory.
   
   

4. SSH to the FortiSIEM Collector and create the reporting device directory:
   
   

   mkdir -p /opt/phoenix/cache/syslog/<reporting-device-IP>

   
   Example:
   
   

   mkdir -p /opt/phoenix/cache/syslog/10.47.X.X

   
   

5. Copy the downloaded text log file to the newly created directory.
   
   

   cp <downloaded-log-file> /opt/phoenix/cache/syslog/<reporting-device-IP>/

   
   

6. Verify that the log file has been copied successfully:
   
   

   ls -lah /opt/phoenix/cache/syslog/<reporting-device-IP>/

   
   

7. Verify the log content:
   
   

   head -3 /opt/phoenix/cache/syslog/<reporting-device-IP>/*.txt

   
   

   Ensure that the file contains the expected text-format syslog entries.
   
   

8. Verify the local syslog file ingestion directory configured in 'phoenix_config.txt':
   
   

   grep '^event_sftp_directory' /opt/phoenix/config/phoenix_config.txt

   
   

   The expected configuration is:
   
   

   event_sftp_directory=/opt/phoenix/cache/syslog

   
   Note: Make sure '#' is not present before the directory path. For example, the following configuration is incorrect:
   
   

   event_sftp_directory= # /opt/phoenix/cache/syslog

   
   

9. Restart the phParser process to apply the configuration:
   
   

   killall -9 phParser

   
   

10. In the FortiSIEM GUI, navigate to Analytics and verify that the events are received and correctly parsed as the expected event type.