Skip to main content
jonathanaxford
jonathanaxford
New Member
August 24, 2016
Solved

Logging to multiple Syslog servers VDOM

  • August 24, 2016
  • 1 reply
  • 31151 views

Hi All, 

 

Fortigate 60D v5.2.4(Build688)

 

I've had a bit of a google and it appears it should be possible to setup my VDOMs to log to multiple Syslog servers, but I am struggling to find out how to get this working. 

I have overridden the global syslog settings to allow me to log per VDOM and this is working. Under the global config I get the option to configure syslogd, syslogd2 and syslogd3, but under the VDOM, I only get the option for syslogd. 

 

VDOM options:

 

FIREWALL (root) # config log custom-field Configure custom log fields. eventfilter Configure log event filters. fortianalyzer Configure first FortiAnalyzer device. fortiguard Configure log for FortiGuard. gui-display Configure log GUI display settings. memory Configure memory log. setting Configure general log settings. syslogd Configure first syslog device. threat-weight Configure threat weight settings.

 

Global options:

 

FIREWALL (global) # config log fortianalyzer Configure first FortiAnalyzer device. fortianalyzer2 Configure second FortiAnalyzer device. fortianalyzer3 Configure third FortiAnalyzer device. fortiguard Configure log for FortiGuard. memory Configure memory log. syslogd Configure first syslog device. syslogd2 Configure second syslog device. syslogd3 Configure third syslog device. webtrends Configure Web trends.

 

Am I missing something? 

 

Any help much appreciated, 

Cheers

Jon

    Best answer by emnoc

    It's doable and little hidden

     

    You have to enable it ; and then magically you can set the server ;)

     

     

    config log syslogd override-setting

        set override enable  <----HERE

        set status enable  <----HERE

        set server "10.1.1.31"  <-----HERE

    end

    1 reply

    Jeff_FTNT
    Staff
    Jeff_FTNT
    Staff
    August 29, 2016

    Hello,

    Each VDOM it can set up override syslog like CLI:config  log  syslogd  override-setting , it only can set up one.

    Only this specific VDOM log sends to override syslogs.

    On global, it can set up 3 syslog  server , all VDOM log will send to 3 different syslog server through Management VDOM, thanks.

    emnoc
    emnocAnswer
    New Member
    September 7, 2016

    It's doable and little hidden

     

    You have to enable it ; and then magically you can set the server ;)

     

     

    config log syslogd override-setting

        set override enable  <----HERE

        set status enable  <----HERE

        set server "10.1.1.31"  <-----HERE

    end

    randomcatperson
    randomcatperson
    Explorer
    February 25, 2019

    Thanks for this. Was what I needed.

    Terms & ConditionsAccessibility statement