Skip to main content
abood
abood
New Member
June 22, 2018
Question

Fortigate Log best practise

  • June 22, 2018
  • 2 replies
  • 5235 views

Hello,

I have fortigate 1000C, I have configured before the logs to both the disk and also to forticloud.

Now I have purchased and enabled logs to FortiAnalyzer also.

I see due to CPU & memory utilization, I have disabled logs to disk since I have now FortiAnalyzer, is it a good or it is better to have also logs to disk in addition to FortiAnalyzer & FortiCloud?

 

thanks in advance

    2 replies

    emnoc
    emnoc
    New Member
    June 25, 2018

    Hmm..... it all depends. Here's my thoughts

     

    1: if FAZ goes down or your connection is down you have no logs

     

    2: ideally you log into two places ( FAZ and   SYSLOG  )

     

    3: As you noted, logging to disk is  and resource eating event and why would you ever want to log to disk and in a smaller appliance make no sense at all imho

     

    What I would do

     

    1: So I would log to FAZ and one SYSLOG if logging was  critical

    2: I would NOT log all traffic data but only  fw-policy-IDs of interest

    3: unless you need for verbose ,  I would use  brief-fromat

     

          http://socpuppet.blogspot...ios-logging-bried.html

     

     

    (NOTE:      yes a org that I just did that had ALL logging types and log all traffic to  FAZ, Disk and AlertLogic and then complained when they  had issues  with memory consumption )

     

    Ken

    kidgradius
    kidgradius
    New Member
    June 25, 2018

    emnoc wrote:

    Hmm..... it all depends. Here's my thoughts

     

    1: if FAZ goes down or your connection is down you have no logs

     

    2: ideally you log into two places ( FAZ and   SYSLOG  )

     

    3: As you noted, logging to disk is  and resource eating event and why would you ever want to log to disk and in a smaller appliance make no sense at all imho

     

    What I would do

     

    1: So I would log to FAZ and one SYSLOG if logging was  critical

    2: I would NOT log all traffic data but only  fw-policy-IDs of interest

    3: unless you need for verbose ,  I would use  brief-fromat

     

          http://socpuppet.blogspot...ios-logging-bried.html

     

     

    (NOTE:      yes a org that I just did that had ALL logging types and log all traffic to  FAZ, Disk and AlertLogic and then complained when they  had issues  with memory consumption )

     

    Ken

    Ken makes a great point. If you have remote firewalls - you might want to have a local location at site that you can store logs, which can be a simple Syslog server. From my understanding - if the firewall unit looses connection to FortiAnalyzer - once the connection is reestablished the logs would populate in FortiAnalyzer.

     

    However, if you have network issues that hinder firewall units from communicating to FortiAnalyzer - I would say you have much bigger issues and gremlins in the system. 

    kidgradius
    kidgradius
    New Member
    June 25, 2018

    I say use FortiAnalyzer. I have noticed on 100D and 600D the CPU spikes when browsing local logs; however, I have no experience with the 1000c.

     

    You could also use syslog server to get RAW log items, which have not been massaged by FortiAnalyzer. I currently use LogRhythm, so that might be an option as well.

    Terms & ConditionsAccessibility statement