EMS Logs Not Ingesting in FortiAnalyzer Only FortiClient Logs Visible

[mhamza]

Hello Fortinet Support,

We are facing an issue where EMS logs are not being ingested into Forti Analyzer. At present, only FortiClient logs are visible, but EMS server activity/logs are not showing up.

Details:

• Product: Forti Analyzer & FortiClient EMS

• Issue: EMS logs not ingesting/forwarding to Forti Analyzer

• Observed: Only FortiClient logs are displayed

• Expected: Both FortiClient and EMS logs should be ingested for full visibility

Request:
Could you please assist us in troubleshooting and resolving this? If any specific configuration or version requirements are needed for EMS log forwarding, kindly provide guidance.

[AEK · Accepted solution]

Hi Hamza

Did you configure log forward to FAZ on your EMS? Can you share a screenshot of the config?

Did you authorize EMS on FAZ?

You can also use "diag sniffer" on FAZ to check if logs are received from EMS.

[mhamza]

Please check the attach configuration snap

[AEK]

The config from EMS side looks fine.

What about FAZ side?

• Did you authorize EMS on FAZ?
• You can also use "diag sniffer" on FAZ (for few minutes) to check if logs are received by FAZ from EMS.

[mrsimon007]

Double-check that EMS log forwarding to FortiAnalyzer is enabled and that both products are on compatible builds. You may also need to verify the EMS connector settings under Device Manager. Fortinet docs list the exact steps.