Skip to main content
carlmcl
carlmcl
New Member
May 5, 2026
Question

Forticlient log retention

  • May 5, 2026
  • 4 replies
  • 57 views

Forticlient local logs in C:\Program Files\Fortinet\FortiClient\logs go back to installation of client. Is there anyway to set log retention in EMS that doesn’t involve uploading logs to FAZ?

4 replies

RBA
Staff
RBA
Staff
May 6, 2026

syslog server logging can be enabled. This should help Technical Tip: Enabling remote logging to FortiAnalyzer or third-party Syslog server | Community

    carlmcl
    carlmclAuthor
    New Member
    May 6, 2026

    I think you misunderstand, I want to control log retention on the device *without* uploading logs anywhere.

    Anthony_E
    Staff
    Anthony_E
    Staff
    May 6, 2026

    Hi,

     

    No, EMS can’t enforce a local log retention policy on the endpoint without involving its own logging pipeline (and by extension, central storage/processing).

    Regards,

    Anthony

    Best Regards
    carlmcl
    carlmclAuthor
    New Member
    May 6, 2026

    so how does an administrator define local log policies? I hope I don’t have to touch every machine.

    Anthony_E
    Staff
    Anthony_E
    Staff
    May 6, 2026

    Hi Carl,

     

    With Fortinet products, it is not possible I guess ( if someone has another answer, I will let him/her indicating it).

     

    Regards,

    Anthony

    Best Regards
    smkml
    Staff
    smkml
    Staff
    May 6, 2026

    Hi ​@carlmcl ,

     

    Either you can opt out the logs that you not require from EMS as per below KB :
     

    Or, control the rate limit on FAZ as per belwo doc:
    https://docs.fortinet.com/document/fortianalyzer/7.4.8/administration-guide/841108/configuring-log-rate-receiving-limits

    Terms & ConditionsAccessibility statement