Logging Philosophy - Options - Combinations - etc.

Question

I would like to hear the Communities responses to a general logging philosophy question for security monitoring, incident investigation, etc. against the performance, storage, etc

How much DON’T you log?

With a bog-standard FortiGate and a bog-standard FortiAnalyser I having issues with the numerous combinations of options on the ‘Log Settings’ page. What is the minimum you would recommend?

For example I can find very little information on the dis/advantages of "Generate Logs when Session Starts"

Or, use local Memory or Disk?

Any advice, insights, etc greatfully received.

Regards
P.

Debbie_FTNT · Answer

Hey Paul,

in general:

- if you HAVE a FortiAnalyzer, I would suggest you log as much as you can get away with (depending on FortiAnalyzer license/sizing/model); any logs might be relevant down the line for investigation/troubleshooting

-> you can refer to the document linked by Anas for some general recommendations

-> If you do have FortiAnalyzer, I would suggest against logging to FortiGate disk, as that can eat up resources on FortiGate

-> if you do not have a FortiAnalyzer, but a FortiGate with disk, I would suggest against logging to FortiGate memory, as that eats into FortiGate memory and can impact performance; depending on available disk space, some logging might need to be disabled

-> I would only suggest to log to FortiGate memory if you have no other options

If you are concerned about logging volume, at the very least:

- retain logging for any sensitive traffic

- retain FortiGate system event logs

- retain logging for any business-critical FortiGate features (VPN, authentication, ...)

- retain logging based on any legal requirements you might have

Sign up

Login with SSO

Login to the community

Login with SSO