Skip to main content
Moonwalker
New Member
November 20, 2017
Question

Stop logging specific events or else edit their priority levels?

  • November 20, 2017
  • 0 replies
  • 2051 views

Our FortiGate FWs are configured to feed logs to FortiAnalyzers and also directly as syslog input to our SIEM.

We are experiencing an issue where nearly half our Events Per Second (EPS) licences for our SIEM solution are exhausted by the Fortigate event logs - and of these, >80% are "Close" event types.

 

"Close" events are categorised as a "notice" event, with severity level=5. 

Is there a way we can selectively stop sending the Close event logs to our SIEM as we don't see this data as proving much value for security event correlation (particularly as it is also partly covered by Netflow traffic)? 

We can't find any information in the Handbook or Reference guide on how to do this at such a granular level and one potential problem is that if we turn off all notice event types (if possible?) we would lose "Firewall Deny" which is a lot more interesting from a security perspective.

 

thanks

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!