| Description | This article describes how to send logs from managed FortiClient endpoints to FortiAnalyzer. |
| Scope | FortiClient endpoints that are managed by FortiClient EMS. |
| Solution |
Access the FortiClient EMS with admin privileges:
Go to Endpoint Profiles -> System Settings:
Select the desired profile and then select 'Edit':
Then scroll down to the Log part and select the option 'Upload Logs to FortiAnalyzer/FortiManager':
Select the desired logs. It is possible to change the telemetry interval, which means the frequency at which the FortiClient will send the logs to the FortiAnalyzer.
Make sure to configure the FortiAnalyzer IP address or FQDN and port below:
For FortiClientEMS-Cloud and FortiAnalyzer-Cloud: Both FortiClient-Cloud and FortiAnalyzer-Cloud should be under the same account.
Select 'Save' at the end. After that, the logs will be sent to the FortiAnalyzer as well. By default, port 514-TCP is used; ensure to allow this communication in VIP and/or Firewall Policies. It can show logs related to FortiClient traffic, all events, and also show vulnerability logs.
|
