Created on 06-24-2024 11:13 PM
This article describes how to prevent the sending of 'subtype=fgfm' logs from FortiManager to the syslog server.
By default, the below logs highlighting fgfm connection changes between FortiManager and managed devices are sent to the syslog server.
date=2023-07-26 time=09:11:12 devname=fortimanager-PROD device_id=FMG-VMTM26001511 log_id=0002011003 type=event subtype=fgfm pri=warning desc="fgfm connection down" msg="fgfm connection to device FGT-LAB-01 is down" user="fgfm" device="FGT-LAB-01"
date=2023-07-26 time=09:09:12 devname=fortimanager-PROD device_id=FMG-VMTM26001511 log_id=0002011003 type=event subtype=fgfm pri=warning desc="fgfm connection up" msg="fgfm connection to device FGT-LAB-01 is up" user="fgfm" device="FGT-LAB-01"
On FortiManager, it is possible to disable the fgfm logging to syslog servers as below :
config sys locallog syslogd filter set fgfm disable end
