New Member

Solved

FGT310B without local (memory) logging.

Forum|Forum|10 years ago
June 20, 2016
11 replies
17206 views

Hi, i have FGT310B (v5.2.3,build670 (GA)) and i can't see the memory logs.

FGT310B (setting) # show full-configuration 
config log memory setting
    set status enable
    set diskfull overwrite
end

FGT310B (setting) # show full
config log setting
    set resolve-ip disable
    set resolve-port enable
    set log-user-in-upper disable
    set fwpolicy-implicit-log disable
    set fwpolicy6-implicit-log disable
    set log-invalid-packet disable
    set local-in-allow enable
    set local-in-deny-unicast enable
    set local-in-deny-broadcast disable
    set local-out enable
    set daemon-log disable
    set neighbor-event disable
    set brief-traffic-format disable
    set user-anonymize disable
end

And I want to see in syslog server (both: server and memory)

FGT310B (setting) # show
config log syslogd setting
    set status enable
    set server "192.168.x.x"
    set facility audit
end

Any ideas?

Thank you very much.

Condor.

5.2

Best answer by ede_pfau

'facility' is not the same as 'logging level'. It's just a label to signify the source to the logging device.

Check the CLI options for 'config log memory settings' and 'config log memory filter'.

Carlos_A_Almeida

New Member

Hello, your Fortigate hasn't a local disk.

FGT310B Module: "Flexible expansion options for four additional NP-accelerated ports or HDD for local logging and archiving"

Your options are: Fortianalyzer, Forticloud or an external syslog server.

condorAuthor

New Member

Thanks for reply Carlos,

Ok, memory don't work without disk. I sending my logs to 192.168.x.x. How could i know that the logs send out from the Fortigate if i cant see logs?

Any ideas?Thanks.

Carlos_A_Almeida

New Member

Sorry Condor, I misread your original post. You are already sending your logs do syslog.

Try to run those commands:

# this will show stats about log creation

diag log kernel-stats

# this will create some testing logs

diag log test

and run diag log kernel-stats again to see if had some increase. And check your syslog to see if those logs are there.

condorAuthor

New Member

Hi, so i run these cmds.

FGT310B # diag log kernel-stats
fgtlog: 1
fgtlog 0: total-log=4942, failed-log=0

FGT310B # diag log test
generating a system event message with level - warning
generating an infected virus message with level - warning
generating a blocked virus message with level - warning
generating a URL block message with level - warning
generating a DLP message with level - warning
generating an IPS log message
generating an anomaly log message
generating an application control IM message with level - information
generating an IPv6 application control IM message with level - information
generating deep application control logs with level - information
generating an antispam message with level - notification
generating an allowed traffic message with level - notice
generating a multicast traffic message with level - notice
generating a ipv6 traffic message with level - notice
generating a wanopt traffic log message with level - notification
generating a HA event message with level - warning
generating netscan log messages with level - notice
generating a VOIP event message with level - information
generating a DNS event message with level - information
generating authentication event messages
generating a Forticlient message with level - information
generating a NAC QUARANTINE message with level - notification
generating a URL block message with level - warning

FGT310B # diag log kernel-stats 
fgtlog: 1
fgtlog 0: total-log=5051, failed-log=0

But, i can see the system log:

I don't know why i cant see traffic?! what is wrong.

Thanks.

ede_pfau

SuperUser

Traffic logs are only generated if you lower the logging level to 'information'.

condorAuthor

New Member

Hi zhunissov4, thats already configured:

ede_pfau, i always use "information" log's level, but in these version only exist these levels:

FGT310B (setting) # set facility kernel Kernel messages. user Random user-level messages. mail Mail system. daemon System daemons. auth Security/authorization messages. syslog Messages generated internally by syslog. lpr Line printer subsystem. news Network news subsystem. uucp Network news subsystem. cron Clock daemon. authpriv Security/authorization messages (private). ftp FTP daemon. ntp NTP daemon. audit Log audit. alert Log alert. clock Clock daemon. local0 Reserved for local use. local1 Reserved for local use. local2 Reserved for local use. local3 Reserved for local use. local4 Reserved for local use. local5 Reserved for local use. local6 Reserved for local use. --More-- local7 Reserved for local use.