Technical Tip: Audit logs are not being forwarded

[nmathur]

Description	This article describes that FortiSOAR audit logs are not being forwarded to FortiSIEM. The Gateway service writes audit logs on this socket:  /run/systemd/journal/syslog This socket is absent on systems with a fresh installation of Rocky Linux, causing log forwarding to fail. However, systems upgraded from CentOS to Rocky Linux have this socket present, allowing log forwarding to function correctly.
Scope	FortiSOAR v7.3.0 through v7.6.0.
Solution	To resolve the issue, create the missing socket on Rocky Linux or RHEL systems, using these steps: yum reinstall systemd ln -s /lib/systemd/system/rsyslog.service /etc/systemd/system/syslog.service systemctl daemon-reload systemctl restart systemd-journald systemctl stop rsyslog Start socket service:  systemctl start syslog.socket Start rsyslog:  systemctl start rsyslog