Skip to main content
A
Anonymous_User
Contributor
June 4, 2010
Question

enable syslog with kiwi

  • June 4, 2010
  • 6 replies
  • 7322 views
hi. would i capture all user traffic with url record and transfer to kiwi syslog throught fortinet syslog function. Which " minimum log level" and " facility" i have to choose. Thanks

    6 replies

    hidayet
    hidayet
    New Member
    June 4, 2010
    Hi Tonycd, Minimum log level - Information Facility - local7
    SECCON1MC
    SECCON1MC
    New Member
    June 4, 2010
    Just an FYI, the traffic logs contain the stats for session bandwidth. The web-filter logs contain the information on urls visited (within a session). You will have to do a lot of parsing, crunching, and correlating to get that data into a single logical " row" of information. Good luck!
    A
    Anonymous_UserAuthor
    Contributor
    June 7, 2010
    thanks all..but i can' t see any url from the syslog. what i did wrong..
    SECCON1MC
    SECCON1MC
    New Member
    June 7, 2010
    make sure everything is enabled that you would want via: 
    config log syslogd filter
    Also make sue you are set to log everything in the protection profile you are using.
    rwpatterson
    rwpatterson
    New Member
    June 7, 2010
    Unlike the FortiAnalyzer, I think the syslog only outputs IP addresses.
    SECCON1MC
    SECCON1MC
    New Member
    June 7, 2010
    rwpatterson - which field are you referring to? I am almost 100% sure that the syslog logs have everything available in it that fortianalyzer logs have. We use the FortiAnalyzer protocol for our service (which allows for easy 3DES encryption of the stream and a DLP of coarse) but have used the syslog transport method in the past without degradation of the available log data.
    rwpatterson
    rwpatterson
    New Member
    June 8, 2010
    LOL! You' re probably right. The one syslog server I set up was capturing inbound traffic. Hence no URI information, duh!
    A
    Anonymous_UserAuthor
    Contributor
    June 8, 2010
    may i was misleading you guys that i want to capture the user traffic log without using fortianalyzer. Thanks all again....
    Terms & ConditionsAccessibility statement