Technical Tip: How to retrieve logs from FortiSIEM VA and deliver them to support

Description

This article describes how to package the FortiSIEM logs to deliver them to Support. 

Scope

FortiSIEM v6.1.0 and above.

Solution

This is a step-by-step guide on how to collect log files over a certain period and send them to a FortiSIEM support team. 

1. Choose the FortiSIEM node on which the last actions have been performed or on which the issue has been encountered.
   
   

2. Download the 'phziplogs' file with the following command on the involved node:

wget "https://drive.usercontent.google.com/uc?id=1pbGmH-NhLp8PZaJ3xuhW-BD1_X2BMcoz&export=download" -O /tmp/phziplogs

3. Move the original phziplogs file:

mv /opt/phoenix/phscripts/bin/phziplogs /opt/phoenix/phscripts/bin/phziplogs_origin

4. Replace phziplogs command with the attached one:
   
   

mv -f /tmp/phziplogs /opt/phoenix/phscripts/bin/phziplogs

5. Apply proper permissions:
   
   

chmod 755 /opt/phoenix/phscripts/bin/phziplogs

6. Collect the logs with the following command. Replace the <ticket_ID> with the ticket number and <number_of_days> with the number of days of historical log data to retrieve:
   
   

phziplogs /tmp/<ticket_ID> <number_of_days>

7. Repeat steps 1 through 7 for all Collectors, Workers, and Supervisors.

8. From the FortiSIEM appliance, directly SCP the log to the desktop:
   

   1. For Windows users, use WinSCP to pull the logs from the /tmp directory of the FortiSIEM appliance.

   2. For Linux users, use SCP from the FortiSIEM bash prompt to copy it out to the local desktop, then upload the file to the support ticket at Support.

   
   

$ scp -r <local directory> username@<host_ip>:<remote directory>

• 3. For Linux users, upload the file to the support ticket at Support.

9. Log in to the Fortinet support account:
   

   1. Find the ticket associated with the log request upload. 

   2. Upload the attachment to the ticket with a response (Note that the upload limit is 500MB per attachment). If required, the support engineer may ask to provide the files through the SCP server to transfer the files.