| Description |
This article describes how to configure the FortiManager to send its local system event log via email notification by using the event handler feature.
If the local system event log matches any condition set in the event handler, it will send email notification. This configuration guide also applies to FortiAnalyzer.
|
| Solution |
Configuration Steps:
- Enable the FortiAnalyzer feature in FortiManager, it requires a reboot.
OR, enable FortiManager log to the external FortiAnalyzer Server:
config system locallog fortianalyzer setting
set status realtime
set server "FAZ"
set severity debug
end
- In FortiManager with the FortiAnalyzer feature or an external FortiAnalyzer, set up the email server via System Settings -> Advanced -> Mail Server -> Create New.
- Test the email server, and the test email should successfully send out a test email.
- In FortiManager with FortiAnalyzer feature or an external FortiAnalyzer, create an event handler under ADOM: root, as the local system event log will match to send an email notification based on the match condition and filter settings.
Note:
For local system event log handling, it must be created under ADOM: root.
- Make sure the handler created is on 'Local Device' if FortiAnalyzer is enabled on FortiManager and/or then fill in the corresponding filter information using logid 0002011003, for example, to detect FortiManager to FortiGate tunnel down.
For this example, a generic text filter to filter off log_id=0002011003, which stands for msg=fgfm connection to device Wira-kvm03 is down, will be used.
log_id=0002011003 type=event subtype=fgfm level=warning desc=fgfm connection down msg=fgfm connection to device Wira-kvm03 is down user=fgfm device=Wira-kvm03 devid=FMG-VM0A17002000 itime=2022-08-01 13:44:07 date=2022-08-01 time=13:44:07 dtime=2022-08-01 13:44:07 itime_t=1659332647
Select the mail server created earlier and save the configuration.
- If any FortiGate to FortiManager connection between FortiManager and FortiGate is down or offline, see the event count increases will be visible and the corresponding log in the system event log as well as in the Alert Message Console in the system dashboard.
- An email notification will be received if the event log matches the event handler that is being configured.
 |
