New Member

Solved

Sending around 300GB (!) logs daily to the FortiGate Cloud, but I have no idea how to stop it

6 replies
4067 views

Hi!

Recently, we bought a FortiGate 40F after we had a 30E in use for some years.

Since some time, it seems that the unit sends around 300GB of logs to the FortiGate Cloud, which seems way too much in my point of view:

For reference, the Log Settings are:

What makes me wonder is that for all the policies under "Policy & Objects - Firewall Policy", it is shown that "All" gets logged:

However, I never configured it like this and when I open the details of a specific policy, I don't see that log "All" is configured. See as an example the details for policy "ENTRY-NET Outgoing Traffic":

So I'm not logging "All" allowed traffic but only if it triggers security events.

Furthermore, no matter what I set here, the "All" in the list of policies changes. So even if I DISABLE "Log Allowed Traffic" here, the list of policies still shows "all" in column "Log" for the policy "ENTRY-NET Outgoing Traffic".

Remark: I have the feeling that this "All"-logging started when I activated the "Security Fabric" under "Security Fabric - Fabric Connectors - Security Fabric Setup":

So my questions are:
- Is 300 GB of daily logs ok? I guess, no.
- If no, what have I done wrong in the configuration? In other words, how can I fix it?
- Why is the value in the Log column of the list of policies different from the actual log setting of a specific policy?

Thanks and best regards,
-Thomas

FortiGate

Yagoba_ITAnswer

New Member

When checking back on the situation last week, it seems that the issue has "self-healed" somehow:

It could have been a side effect of updating the FW from v7.2.3 to v7.2.4 some time ago...

BTW, it took me some time to find this chart agin in the new firmware, because it moved from Log & Report > Log Settings (in v7.2.3) to Security Fabric > Fabric Connectors > Logging & Analytiscs > Settings > Cloud Logging (in v7.2.4).

gfleming

Staff

You need to see the logs to understand what is causing the abundance of log messages.

You can also enable the "Hit Count" column in your Firewall Policy view to see which policies have the highest hit count. This would tell you most likely the culprit. I would assume it's an internal traffic policy and you have something very chatty inside your network.

Yagoba_ITAuthor

New Member

Hi Graham,

thanks for your fast response and your help.

From my pic above showing the list of policies (fig. 3) you can see that policy "ENTRY-NET Outgoing Traffic" handles by far the highest amount of (outgoing) traffic. It is actually all the outgoing fraffic of the desktops, laptops and servers in our office. So this should be the policy producing the highest amount of log messages. To be completely sure, see below the hit count you suggested:

Fig. 6 Fig. 6

So also the hit count indicates that the policy "ENTRY-NET Outgoing Traffic" will by far cause the most log entries. Please note that only internal policy we have so far is the policy "ENTRY-NET to DMZ-NET Bridging" and it only has 85 hits (currently).

So I still think the "All" value for all policies in column "Log" is a/the problem.

Why is this colum permanently showing "All" no matter what I set in the Logging Options of a specific policy (as I described in my original post in fig. 4)?
Is it maybe wrong to setup the (only) FortiGate we have as a Security Fabric Root (see fig. 5 in my original post) because this activates something like "full logging for all policies"? Or do we need to setup "filters for log messages we consider acceptable"?

Regards,
-Thomas

gfleming

Staff

Yes enabling security fabric enables logging of all traffic. Honestly though it sounds like something is wrong you should not have that much logs being sent for that low traffic/hit counts.

Can you go to FortiGate Cloud Analysis, FortiView, Traffic Analysis, Source and then sort the resulting table by Sessions count? Change from 60 minutes to 24 hours.

I would imagine there's going to be a very chatty device causing many log messages. We can try and narrow it down this way...

Yagoba_ITAuthorAnswer

New Member

When checking back on the situation last week, it seems that the issue has "self-healed" somehow:

It could have been a side effect of updating the FW from v7.2.3 to v7.2.4 some time ago...

BTW, it took me some time to find this chart agin in the new firmware, because it moved from Log & Report > Log Settings (in v7.2.3) to Security Fabric > Fabric Connectors > Logging & Analytiscs > Settings > Cloud Logging (in v7.2.4).

Sign up

Login with SSO

Login to the community

Login with SSO