Skip to main content
Anonymous_User
Esteemed Contributor III
May 28, 2010
Question

Unable to LOG anything to a syslog server

Hello, I' m getting mad. I' m unable to send any log messages to a syslog server installed in a PC. The syslog server works, but the Fortigate doesn' t send anything to it. It' s a Fortigate 200B, firm 4.0 build 0178 (MR1). I think everything is configured as it should, interfaces are set log enable, and policy rules I would like to log are log allowed. But it doesn' t work. I' m getting mad. Do I need to reset the firewall after configure logging ? Can I restart log service only ? Firmware bug ? Thanks

    17 replies

    Show previous replies
    Anonymous_UserAuthor
    Esteemed Contributor III
    June 2, 2010
    Thanks, I can see it' s similar as Linux process. Watchdog started again syslog daemon , but still no packets received at syslogd server. A packet sniffing show this once and once again: interfaces=[any] filters=[port 514] 5.210139 192.168.100.1.24678 -> 192.168.100.21.514: syn 3924309279 5.210148 192.168.100.1.24678 -> 192.168.100.21.514: syn 3924309279 5.210348 192.168.100.21.514 -> 192.168.100.1.24678: rst 0 ack 3924309280 192.168.100.1 is Fortinet and 100.21 is syslogd server. Is this good or bad ? Thanks
    abelio
    SuperUser
    abelio
    SuperUser
    June 2, 2010
    hummm... your syslog at 100.21 is resetting connections. 5.210348 192.168.100.21.514 -> 192.168.100.1.24678: rst 0 ack Re-check firewalling rules within that linux box
    SECCON1MC
    SECCON1MC
    New Member
    June 2, 2010
    jmac - You are right on. That is the FortiGate trying to speak " FortiAnalyzer" talk. 514 tcp - is used for information like that nice green check mark, quota and storage info, FAZ log access, etc. You will also see 514 udp when using a FAZ as well. Let' s tripple check everything is setup for use with a sysog server. -Matt
    Anonymous_UserAuthor
    Esteemed Contributor III
    June 3, 2010
    Ok, it works now I disabled " reliable" feature, maybe reliable makes the communication using TCP instead of UDP, but I remember I tested some days ago with and without realiable and nothing worked, but now it works. Thank you very much to all of you
    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT