Technical Tip: How to send specific log from FortiAnalyzer to syslog server via 'Log Forwarding'

[tnaik]

Description

This article describes how to send specific log from FortiAnalyzer to syslog server.

For this demonstration, only IPS log send out from FortiAnalyzer to syslog is considered.

Solution

1) Check the 'Sub Type' of log.

From GUI, go to Log view -> Fortigate -> Intrusion Prevention and select log to check 'Sub Type'.

 

2) Apply filter under 'Log Forwarding'.

Log Field: Generic free-text filter, Match criteria:Match, Value:subtype=ips    <-----Check the below screenshot.

This will only send logs with sub-type IPS.

3) CLI will show the configuration as below:

Troubleshooting:

Technical Tip: Integrate FortiAnalyzer and FortiSIEM

Related articles:
https://docs.fortinet.com/document/fortigate/6.0.4/fortios-log-message-reference/160372/list-of-log-...
https://docs.fortinet.com/document/fortianalyzer/6.2.8/cli-reference/859805/log-forward