Send logs to wazuh and syslog server

Hi Van

Two possible methods:

1. On syslog you forward the received FGT logs to Wazuh (sometime the preferred method)
2. Use FGT CLI to add a second syslog destination
   

   config log syslogd2 setting

   You can configure additional servers with syslog3 and syslog4.

Hope it helps.

FortiGate can send logs to multiple syslog destinations, but simply duplicating the same raw stream does not always solve the operational problem. The main challenge usually starts on the Wazuh side: different FortiOS versions and event types may produce inconsistent fields, message formats and device identifiers.

I’m currently using Bivoxy with five devices connected. In my setup, it sits between the FortiGate devices and the analysis layer, receives the raw syslog events, preserves the original device identity and normalizes fields such as source IP, destination IP, user, action, policy ID, event type and severity into a consistent structure.

This has been useful because Wazuh can receive the logs in a more predictable format instead of relying on a growing collection of custom decoders and firmware-specific field mappings. It also makes cross-device correlation easier, especially for VPN authentication failures, repeated connection attempts and policy-related events.

For this setup, I would verify the following:

• Both syslog targets are receiving events independently.
• FortiGate is using reliable TCP or TLS syslog where possible.
• The original hostname, serial number or device identifier is preserved.
• Wazuh is decoding and indexing the events, not only writing them to the archives.
• Message size, framing and timestamp formats are consistent.
• Events from different devices are not being merged under the same source identity.

A centralized normalization layer is not mandatory, but once you have several FortiGate devices or mixed firmware versions, it can remove a lot of decoder maintenance. Bivoxy has been working well for this in my environment, especially for keeping the event structure consistent before analysis.