FortiGate 100 Syslog Facility

What I want is to have FortiGate' s logs in a separate file, that' s why I need to know the facility.

I bet you haven' t read your Fortigate manual... here you go. Recording logs on a remote computer Use the following procedure to configure the FortiGate unit to record log messages on a remote computer. The remote computer must be configured with a syslog server. 1 Go to Log&Report > Log Setting. 2 Select Log to Remote Host to send the logs to a syslog server. 3 Type the IP address of the remote computer running syslog server software. 4 Type the port number of the syslog server. 5 Select the severity level for which you want to record log messages. The FortiGate will log all levels of severity down to but not lower than the level you choose. For example, if you want to record emergency, alert, critical, and error messages, select Error. 6 Select Config Policy. • Select the Log type for which you want the FortiGate unit to record logs. • For each Log type, select the activities for which you want the FortiGate unit to record log messages. •Select OK. For more information on log types and activities, see “Filtering log messages” on page 251 and “Configuring traffic logging” on page 253. 7 Select Apply.

i bet you didn' t understand the question... I already did what you described (several times in different FortiGate boxes), but I' m asking for a different thing. As you described all the steps to log in a syslog server, you know perfectly that there' s no place where we can specify the syslog facility (e.g. " local0" , not the severity level) in the FortiGate' s configuration interface. I believe there must be a default (and unfortunatly fixed) facility where FortiGate sends its logs. The name of this syslog facility is what I' m looking for. Kind regards, Marcos

With 2.80 MR10 Test # conf log syslogd setting (setting)# sh config log syslogd setting set facility local0 set server " 192.168.200.240" set status enable end (setting)# set facility alert log alert audit log audit auth security/authorization messages authpriv security/authorization messages (private) clock clock daemon cron clock daemon daemon system daemons ftp ftp daemon kernel kernel messages local0 reserved for local use local1 reserved for local use local2 reserved for local use local3 reserved for local use local4 reserved for local use local5 reserved for local use local6 reserved for local use local7 reserved for local use lpr line printer subsystem mail mail system news network news subsystem ntp ntp daemon syslog messages generated internally by syslogd user random user-level messages uucp network news subsystem (setting)# set facility You can also do this from the GUI - it just doesn' t paste as well. Seems straightforward - did I understand it?

Great! That' s the answer I was looking for.

Hi I was wondering if someone could help me use the syslog Facility. As i have checked the manual it provides little info. on it. i need to no the basic setup and what way i can get it to work. installing a syslog server on windows machine xp/2003 server(free or trail software). setting fortigate to use syslog(i think i no how jus don' t seem to log to a machine with any bit of software i have tried) and anything else i should no. Thanks

The Syslog configuration of FortiGate is limited to the options of " Log&Reports" , " Log Config" , " Syslog" , so the problem may be outside the FortiGate. Check the following: * Syslog packets (UDP 514) generated by FortiGate must be allowed to reach the syslog server. There may be a firewall preventing this or a routing problem. If you use Windows, try installing Windump (http://www.winpcap.org/windump/). In my experience, windump is not very stable, so be careful if you are in a production environment. In a UNIX box, tcpdump will help you trace packets. * There may be a problem with the configuration of your syslog server. Try testing your syslog server with a syslog client (e.g. Kiwi SyslogGen from http://www.kiwisyslog.com). Kind regards, Marcos