Question
Trying to send Syslog from Fortinet to Ubuntu Rsyslog but I only get "RT_FLOW" and "RT_IDS"
I am working at a SOC where we receive traffic from Fortinet firewalls.
One of my contacts has configured syslog to my Ubuntu server, but I only see the following data:
<11>Dec 5 13:32:16 ti110211101x110 RT_IDS <14>Dec 5 13:32:16 ti110211101x110 RT_FLOW
I would think that I should have this type of data:
<45>date=2024-07-03 time=09:29:01 devname="alpha-fortigate" devid="FGT40FTK2209B06Q" eventtime=1719991739997635239 tz="+0200" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" srcip=192.168.1.110 srcport=55178 srcintf="lan" srcintfrole="lan" dstip=1.1.1.1 dstport=53 dstintf="wan" dstintfrole="wan" srcuuid="f8eef6a8-718a-51ee-c800-48fa677761f7" dstuuid="f8eef6a8-718a-51ee-c800-48fa677761f7" srccountry="Reserved" dstcountry="Australia" sessionid=79980663 proto=6 action="close" policyid=1 policytype="policy" poluuid="feafac0e-718a-51ee-3d8f-17868e4a5bab" policyname="Default test" service="DNS" trandisp="snat" transip=192.168.94.242 transport=55178 duration=2 sentbyte=311 rcvdbyte=363 sentpkt=5 rcvdpkt=5 appcat="unscanned"
Are there any one that can see what is wrong?
