Filter log severity sent to FAZ

[etonsrawi]

Hi Everybody,

I'm currently sending logs from a Fortigate to a FortiAnalyzer and which to send only logs with the severity level prior or equal to error (3) to the Fortianalyzer, while keep logging lowest level (information, debug, notification and warning) locally on the Fortigate. Based on my search, I prepare the following config :

config log fortianalyzer filter set severity error set forward-traffic enable set set local-traffic enable set anomaly enable end

Does anybody can confirm this ? Or have already achieve this and know how it works ?

Thanks in advance.

[gfleming]

Sounds like you have it correct. The CLI reference is here: https://docs.fortinet.com/document/fortigate/7.2.3/cli-reference/496620/config-log-fortianalyzer-fil...

Are you having any issues with this?