Description | This article describes how FortiAnalyzer allows the forwarding of logs to an external syslog server, Common Event Format (CEF) server, or another FortiAnalyzer via Log Forwarding. This article illustrates the configuration and some troubleshooting steps for Log Forwarding on FortiAnalyzer. |
Scope | FortiAnalyzer. |
Solution |
Note: Log forwarding may also be optimized in terms of bandwidth by using compression (only when sending to FortiAnalyzer):
config system log-forward edit "x" set fwd-compression enable end
Troubleshooting:
Enable debug on logfwd process and restart logfwd:
diagnose debug application logfwd 8 diagnose debug en diagnose test application logfwd 99
Let it run for a few minutes and disable debug:
diagnose debug disable
Note: By default, not selecting any device in Log Forwarding Filters -> Device Filters means all devices in the ADOM are forwarding the logs.
Note: There is no feature for FortiAnalyzer to create reports for its system events. It has to be a device other than the FortiAnalyzer itself.
Related articles: Log forwarding to SIEM: Technical Tip: Integrate FortiAnalyzer and FortiSIEM Log forwarding to FortiAnalyzer: Technical Tip: Log forwarding from Collector mode FortiAnalyzer to Analyzer mode FortiAnalyzer |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.