Technical Tip: How to send a specific log from FortiAnalyzer to the syslog server via 'Log Forwarding'

[tnaik]

Description

This article describes how to send specific log from FortiAnalyzer to syslog server.

For this demonstration, only IPS log send out from FortiAnalyzer to syslog is considered.

Solution

1. Check the 'Sub Type' of the log.

From the GUI, go to Log view -> FortiGate -> Intrusion Prevention and select the log to check its 'Sub Type'.

2. Apply the filter under 'Log Forwarding'.

Log Field: Generic free-text filter, Match criteria:Match, Value:subtype=ips    <-----See the screenshot below.

This will only send logs with the IPS sub-type.

3. The CLI will show the configuration as below:

Troubleshooting:

If issues are encountered with log forwarding, check the log forwarding stats by using the following command:

diagnose test application logfwd 4

If there are issues with the forwarding engine, reset the logfwd process:

diagnose test application logfwd 99

diagnose test application logfwd

Related articles:

• Technical Tip: Integrate FortiAnalyzer and FortiSIEM
  
• List of log types and subtypes - FortiGate documentation
  
• log-forward - FortiAnalyzer CLI reference