Hi, I am not sure that the FG-200B has a log disk or only some flash. Check the cli settings: config log disk setting set status enable set storage <disk, memory, FLASH> --- usually these are the options !!! changing the storage may require to reboot the device !!! or config log memory setting set status enable The most important is to check where the logs are stored and set the gui settings to read these logs: config log setting set gui-location <memory, disk, fortianalyzer...> If I were you I try this: config log setting get --- check the gui-settings if it is memory, disk etc... than config log disk setting get config log memory setting get --- check the " status" enable/disable at these two options. If you have somewhere enabled than set the gui-location to that. Optionally you can set to log to disk, flash etc with the commands above. Be aware of the possobility that the FortiGate will need to be restarted. It will warm you and ask you whether to continue and reboot or discard the settings and not reboot.
back to the rem-syslog server, you can do a diag snifffer packet " interface-name" ' port 15000' and see if any traffic is sourced from the firewall to the host you can also do that on the server quite easily. Make sure logging is enabled If you see traffic, than check the unix facilities local7 o kill -HUP the syslogd daemon. Make sure the process can write to the file as a permission check ( assuming unix ) chmod the file to 777 as temp and see if files are written. If you see syslog data write than you know it' s a daemon write-accesss/ownership issue. btw splunk is good
Hi AtiT and emnoc, I tried sniffer port 1500 on fortigate ip and there are no ip packets in this port, any idea ? Thank you for important help. (syslog server configured on global VDOM, need configure this in all VDOM ? )
Any suggestions? Atit, you can show your setting for syslog server (config log syslogd setting ..) In " source-ip" you have an address ? Thank you in advance
Yes,I can ping my syslog server (10.0.14.94), Sniffer is on syslog server (I can ping fortinet on syslog server) and a try filter on port 15000(port for syslog in a configuration). I think fortinet not send any packet on this port.
Now I' m really confused, we have 2 screen shots 10.0.17 and 10.0.14 .94 which is it? Now to diagnose this, we need you double check port and ip_address. And provide the following; show log syslogd filter show log syslogd setting show log memory Next, set up a sniffer to list on the port that you have syslog running on < 15000 > ???? And then execute a logging event like a failed admin login or even easier execute a diag test log You should see a syslog packet generated and sent to the syslog. i.e FG200B1G02811942 # diag log test generating a system event message with level - warning generating an infected virus message with level - warning generating a blocked virus message with level - warning generating a URL block message with level - warning generating a DLP message with level - warning generating an attack detection message with level - warning generating an application control IM message with level - information generating an application control VOIP message with level - information generating an antispam message with level - notification generating an allowed traffic message with level - notice generating a wanopt traffic log message with level - notification generating a HA event message with level - warning
Hi, sorry I change IP address of syslog server ... I attached all command requested, view log but seems fortinet not send log at port 1500. I do not understand ... Thank you for support..
Okay now that we see the problems & more of your setup, are you trying to log within a vdom or global and where does 10.0.14.94 or 10.0.17.94 interface resides in ( root-vdom, BASSO, etc...) Have you did what i suggested earlier show config for the logging in the vdom that you specific logging from?
10.0.14.94 resides in BASSO vdom .. In vdom " BASSO" i can' t set syslog server configuration ? only in global i can set syslog server ? I can view log with " diag log test" in vdom " BASSO" Thanks
