Technical Tip: Setting Filter Based on Severity for External Syslog in FortiGate

[ddeguzman]

Description	This article discusses setting a severity-based filter for External Syslog in FortiGate.
Scope	FortiGate.
Solution	When using an external Syslog server for receiving logs from FortiGate, there is an option that lets filter it based on the log severity. By setting the severity, the log will include messages under the selected severity and include the above severities. By default, it is set to information. The severity levels are as below:  Parameter Description Emergency Emergency level. Alert Alert level. Critical Critical level Error Error level. Warning Warning level. Notification Notification level. Information* Information level. Debug Debug level.   CLI Command: config log syslogd filter     set severity (parameter) <-----  Debug, information*, notification, warning, error, critical, alert, emergency. end When using FortiAnalyzer/FortiManager for receiving logs from the FortiGate, to configure log filter settings to determine which logs will be recorded (for example: 'Warning', 'Critical', or 'Alert'), the following command should be used: config log fortianalyzer filter     set severity warning      <-----  Debug, information*, notification, warning, error, critical, alert, emergency. end Related article: Technical Tip: Filtering specific event logs that will be forwarded to a syslog server