Skip to main content
albaker1
New Member
March 24, 2023
Solved

Question on Logging Configuration in Firewall Policy

  • March 24, 2023
  • 3 replies
  • 2772 views

Being new to the FortiGates, I probably have a misunderstanding on the log settings within the firewall policy. In the FortiManager, we have certain lines set to "Log All Sessions" that we are particular interested in, with the majority set to either "Log Violation Traffic" (for blocks) or  "Log Security Events", and it's set this way with the intent of somewhat restricting logs that are being sent to our SIEM. We have to pay for extra log data, so we'd like to trim out what isn't needed.

 

After troubleshooting today, I believe this affects what's presented in the Log & Report > Forward Traffic. There were no results for a lline configured with "Log Security Events", but there was after this was changed to "Log All Sessions."

 

Is it typical practice to set every line in the Firewall Policy to "Log All Sessions." I understand there is a logging level configured in the syslog configuration, but does the logging level in the firewall policy affect what goes out via syslog?

 

Thank you.

Best answer by funkylicious

If I'm not mistaken, only for local traffic/logs or sent to FortiAnalyzer.

Syslog has it's own settings in regards to facility.

3 replies

funkylicious
SuperUser
SuperUser
March 24, 2023

"Log security events" will only show up traffic log match UTM profile defined.
"Log all sessions" will include traffic log include both match and non-match UTM profile defined.

"jack of all trades, master of none"
albaker1
albaker1Author
New Member
March 24, 2023

Is this only for the local logs on the FortiGate or does it include syslog or both?

 

funkylicious
SuperUser
SuperUser
March 24, 2023

If I'm not mistaken, only for local traffic/logs or sent to FortiAnalyzer.

Syslog has it's own settings in regards to facility.

"jack of all trades, master of none"
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.