Explorer II

Question

Where is my data of fortinet?

Forum|Forum|4 years ago
July 30, 2022
4 replies
3263 views

Hello, I installed Elasticsearch and kibana and filebeat in ubuntu 22.04 VM and i installed FortiGate 7.2.0 in other VM in VMware workstation, I follow the steps to upload the Fortinet logs in elastic and kibana as the first screenshot, and the data is successfully received from the Filebeat Fortinet module but when i clic in "security App" i don't find anything

this my nano /etc/filebeat/modules.d/fortinet.yml:

- module: fortinet
firewall:
enabled: true

# Set which input to use between tcp, udp (default) or file.
var.input: udp

# The interface to listen to syslog traffic. Defaults to
# localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_host: 192.168.37.2

# The port to listen for syslog traffic. Defaults to 9004.
var.syslog_port: 9004

# Set internal interfaces. used to override parsed network.direction
# based on a tagged interface. Both internal and external interfaces must be
# set to leverage this functionality.

and this my config log syslogd setting of fortigate :

FortiGate-VM64 # config log syslogd setting

FortiGate-VM64 (setting) # show

config log syslogd setting

set status enable

set server "192.168.37.2"

set port 9004

end

FortiGate-VM64 (setting) #

FortiGate

Anthony_E

Staff

Hello Firasbg,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

Best Regards

Markus_M

Staff & Editor

Hi Firasbg,

with a packet capture you should see whether FortiGate sends logs on the respective port 9004. Cannot really help on kibana or elasticsearch, but first I would make sure the devices receive the data from the FortiGate.

Then see whether the devices can read the data as to see the correct syslog format, separated correctly with correct delimiters.

Best regards,

Markus

Best regards, Markus

FirasbgAuthor

Explorer II

how to do that? how to do capture? how to see if the devices receive the FortiGate logs ??

i'am new in fortigate

Debbie_FTNT

Staff & Editor

Hey Firasberg,

regarding a capture on FortiGate, you can check as outlined in the screenshot below:

Once you click on start, the screen will show a display of the ongoing capture with some basic info; if you end the capture, you can download a resulting pcap file and look at it in wireshark or similar.

This way you can verify if FortiGate is actually sending on port 9004.

As for checking on the receiving hosts, you should be able to use the tcpdump command in Ubuntu for example, but I'm not terribly familiar with it, my apologies.

Sign up

Login with SSO

Login to the community

Login with SSO