Technical Tip: How to send Syslog from Linux (Ubuntu) based to FortiAnalyzer

[Nur]

Description	This article describes how to send syslog from a Linux (Ubuntu) based to FortiAnalyzer.
Scope	FortiAnalyzer and Linux (Ubuntu).
Solution	FortiAnalyzer is only able to receive logs from Ubuntu Linux-based based. If other Linux-based systems send logs to FortiAnalyzer, the syslog section will be 'web server error'. The Ubuntu workstation needs to have the EMS/FortiClient installed to the workstation. Configure FortiAnalyzer at the EMS system settings. From the FortiAnalyzer side, two authorization devices will pop up at Device Manager: (enable ADOM): EMS. Syslog. To ensure Ubuntu sends logs to FortiAnalyzer, it is possible to enable the configuration-based guide below: Log in as root: login as: root root@10.47.4.XX's password: Access to/etc folder: root@preve-kvm39:~# cd /etc Edit rsyslog.conf file (syslog config): root@preve-kvm39:/etc# vi rsyslog.conf Add FortiAnalyzer info: # Include all config files in /etc/rsyslog.d/ # $IncludeConfig /etc/rsyslog.d/*.conf *.*@10.47.5.XX:514 #For UDP Refresh the FortiAnalyzer, and it will show the event log of Ubuntu.