Description
This article describes how new format Common Event Format (CEF) in which logs can be sent to syslog servers.
Scope
FortiGate.
Solution
FortiGate can configure FortiOS to send log messages to remote syslog servers in CEF format. CEF is an open log management standard that provides interoperability of security-related information between different network devices and applications. CEF data can be collected and aggregated for analysis by enterprise management or Security Information and Event Management (SIEM) systems such as FortiSIEM.
FortiOS supports logging to up to four remote syslog servers. Each server can now be configured separately to send log messages in CEF or CSV format. Previously, only the CSV format was supported.
Use the following command to configure syslog to use CEF format:
CLI:
config log syslog setting
set format cef
end
Note:
All other syslog settings can be configured as required independently of the log message format, including the server address and transport (UDP or TCP). You can also configure filtering for both CEF and CSV-formatted log messages.
To confirm what format is currently used to send syslog:
show full-configuration log syslogd setting | grep -i format
To check what format is available:
config log syslog setting
set format ?
default Syslog format.
csv CSV (Comma Separated Values) format.
cef CEF (Common Event Format) format.
rfc5424 Syslog RFC5424 format.
json JSON (JavaScript Object Notation) format.
