Skip to main content
eager2learn
eager2learn
New Member
April 11, 2019
Question

Unusual field usage in syslog records.

  • April 11, 2019
  • 2 replies
  • 5976 views

We use a Fortigate 200D with Firmwarw v.5.4.3,build1111(GA)

In "Log & Report", "Log Settings", "Remote Logging and Archiving"

"Send Logs to Syslog" is set on.

IP Address/FQDN: (is filled with the IP-address of a Graylog server.)

"Local Traffic Log" is set off.

"Event Logging" is set on

All event are set on.

 

The Graylog server receives the syslog records from the Fortigate.

But the format of the syslog records is unusual.

In the syslog record field "source" we expect the hostname of the Fortigate but the content is "date=2019-04-11".

Is this caused by a wrong setting?

Can we change this?

Or is this a bug?

 

 

2 replies

Alivo__FTNT
Staff
Alivo__FTNT
Staff
April 14, 2019

Hello, Could you paste here the whole log?

 

Alivo

eager2learn
eager2learnAuthor
New Member
April 15, 2019

Do you need one syslog record send by the Fortigate? Can the Fortigate deliver this syslog record?

Or shall I let wireshark capture a syslog record of the fortigate?

 

eager2learn
eager2learnAuthor
New Member
April 15, 2019

With tcpdump I got a log message from the Fortigate to the Graylog-server.

Msg: date=2019-04-15 time=16:15:33 devname=FG200D-Mailstreet devid=FG200D3916815285 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=192.168.0.226 srcname="AUTOMATION-TEST" srcport=55416 srcintf="lag-trust" dstip=192.168.10.16 dstport=61953 dstintf="lag-dmz" poluuid=a599932a-defa-51e6-46df-62c214fc6a99 sessionid=1546271439 proto=6 action=close policyid=10029 policytype=policy dstcountry="Reserved" srccountry="Reserved" trandisp=noop service="tcp/61953" duration=2 sentbyte=240 rcvdbyte=200 sentpkt=5 rcvdpkt=4 appcat="unscanned" devtype="Windows PC" osname="Windows" osversion="7 or 8" mastersrcmac=00:50:56:b6:e1:63 srcmac=00:50:56:b6:e1:63

 

A Ubuntu Linux system send the message below to the Graylog-server:

Msg: 1 2019-04-15T17:14:13.334327+02:00 test02 sshd 18557 - -  pam_unix(sshd:session): session opened for user eager2learn by (uid=0)\0x0a

 

Graylog recognizes the syslog message from the Ubuntu Linux system and use "test02" as system name.

On the Ubuntu Linux system I set "RSYSLOG_SyslogProtocol23Format".

 

It seems that the Fortigate use another SyslogProtocol Format.

Graylog use "date=2019-05-15" as system name for the message from the Fortigate.

 

Frosty
Frosty
New Member
April 17, 2019

Haven't used Graylog, however we syslog from FG200E to ManageEngine Event Log Analyzer and it works okay. 

 

But I had to specify the "type" of the syslog format in Event Log Analyzer at the receiving end, so chose simply "Unix" as the type ... and it worked.

 

I assume you've read through this:  http://docs.graylog.org/en/3.0/pages/sending_data.html

Terms & ConditionsAccessibility statement