Difference between FortiAnalyzer and Syslog?

[Elderusr]

Hello Folks,

I'd like to know if someone can explain to me in a nutshell the difference between sending all logs to a FortiAnalyzer instance instead of a Syslog instance?

Thanks!

[mnantel_FTNT]

Hi Joshua,

Technically, the information sent to both should be the same, if thats the intent of your question?

Rather obviously, sending it to a FortiAnalyzer means you are getting the log presentation aspects of FortiAnalyzer (and you are storing that data on a FortiAnalyzer) rather than whatever you are going to send to a syslog server.

Some customers who have an existing logging solution such as Splunk can use Fortinet modules that we have designed in partnership with splunk. You might not get all of the same level of information presentation as what you get on FortiAnalyzer (the later being designed specifically to parse and analyze logs from FortiGate), but the data should more or less be the same. One thing that FAZ does which your average syslog wont support is the ability to receive archival data like PCAPs or quarantined files. This is sent to FAZ using OFTP, which was designed specifically for FAZ.

Hope this helps - if not feel free to clarify your question!

Mat

--

Mathieu Nantel - NSE4, CCIE 24349

Principal System Engineer / Consultant Technique Senior, Office of the CTO

[Elderusr]

Hi Mathieu,

Yes. This very much does clarify my question. I was just wondering if there was any lost feature sets other than what was mentioned in your post by using Syslog vs FAZ. Looking to mainly use this as an interim until at a later date we can get FortiAnalyzer setup on-prem.

Thanks for your time.

Josh