Skip to main content
thomasevig
New Member
June 26, 2018
Solved

syslog server configured yet syslog server not getting any logs

  • June 26, 2018
  • 4 replies
  • 6181 views

hello,

 

i've configured syslog server on of our clients' vdom,

including the configuration -

 

config log syslogd override-setting <---     set override enable     set status enable     set server "CUSTOMER EXTERNAL SERVER IP (OMMITED for security measurments) "     set reliable enable     set port 601     set facility syslog <---     set source-ip "OUR VDOM EXTERNAL IP ( OMMITED for security measurments) "     set format default end config log syslogd override-filter <---     set severity notification     set forward-traffic enable     set local-traffic enable     set multicast-traffic enable     set sniffer-traffic enable     set anomaly enable     set voip enable     set dns enable     set filter ''     set filter-type include end

 

 

 

 

diagnose sniffer packet any "host ***** and port 601" 4 0 interfaces=[any] filters=[host ***** and port 601] 0.905981 ***-WAN out *****.10568 -> ******.601: fin 2063666531 ack 1219845830 0.905983 WAN out ommited.10568 -> *****.601: fin 2063666531 ack 1219845830 0.905984 port35 out ommited.10568 -> *****.601: fin 2063666531 ack 1219845830 0.906015 ***-WAN out ommited.6695 -> *****.601: syn 3437827387 0.906016 WAN out ommited.6695 -> *****.601: syn 3437827387 0.906017 port35 out ommited.6695 -> *****.601: syn 3437827387

 

 

according to the results and configuration , all configured properly yet the server doesn't receive any logs from the fortigate.

 

thanks in advance ,

 

Thomas .

 

Best answer by Toshi_Esumi

Did you configured syslog server at global? We never tried this but it might be an issue if you don't have it there before you can override it at a vdom. Hopefully somebody else has experiences.

4 replies

Toshi_Esumi
SuperUser
SuperUser
June 26, 2018

Did you configured syslog server at global? We never tried this but it might be an issue if you don't have it there before you can override it at a vdom. Hopefully somebody else has experiences.

emnoc
New Member
June 26, 2018

Yes that cfg is good. So the  dump show syn/ack and fin so what is configured at whatever syslogd server and what does diag debug flow show  ?

 

Yes any  thing done at the override override the global.

 

 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!