|
When using syslog in reliable mode, FortiGate sends logs over TCP. This can result in multiple payloads being merged when received by some SIEM systems, such as IBM QRadar, especially if the parser is not properly handling message boundaries.
To resolve this behavior, switch the syslog transmission mode from reliable (TCP) to UDP, which sends logs as discrete datagrams and helps the server process them individually.
Use the following CLI commands on the FortiGate to change the syslog mode:
config log syslogd setting
set mode udp
end
After this change, FortiGate will send syslog messages using UDP by default, preventing multiple payloads from merging into a single entry.
Note:
Ensure that the receiving system (for example, QRadar) is configured to accept and properly parse syslog over UDP.
For more information about syslog configuration, refer to this KB article: Technical Tip: How to configure syslog on FortiGate.
|
