Fortigate Log best practise

[abood]

Hello,

I have fortigate 1000C, I have configured before the logs to both the disk and also to forticloud.

Now I have purchased and enabled logs to FortiAnalyzer also.

I see due to CPU & memory utilization, I have disabled logs to disk since I have now FortiAnalyzer, is it a good or it is better to have also logs to disk in addition to FortiAnalyzer & FortiCloud?

thanks in advance

[emnoc]

Hmm..... it all depends. Here's my thoughts

1: if FAZ goes down or your connection is down you have no logs

2: ideally you log into two places ( FAZ and   SYSLOG  )

3: As you noted, logging to disk is  and resource eating event and why would you ever want to log to disk and in a smaller appliance make no sense at all imho

What I would do

1: So I would log to FAZ and one SYSLOG if logging was  critical

2: I would NOT log all traffic data but only  fw-policy-IDs of interest

3: unless you need for verbose ,  I would use  brief-fromat

      http://socpuppet.blogspot...ios-logging-bried.html

(NOTE:      yes a org that I just did that had ALL logging types and log all traffic to  FAZ, Disk and AlertLogic and then complained when they  had issues  with memory consumption )

Ken

[kidgradius]

emnoc wrote:

Hmm..... it all depends. Here's my thoughts

1: if FAZ goes down or your connection is down you have no logs

2: ideally you log into two places ( FAZ and   SYSLOG  )

3: As you noted, logging to disk is  and resource eating event and why would you ever want to log to disk and in a smaller appliance make no sense at all imho

What I would do

1: So I would log to FAZ and one SYSLOG if logging was  critical

2: I would NOT log all traffic data but only  fw-policy-IDs of interest

3: unless you need for verbose ,  I would use  brief-fromat

      http://socpuppet.blogspot...ios-logging-bried.html

(NOTE:      yes a org that I just did that had ALL logging types and log all traffic to  FAZ, Disk and AlertLogic and then complained when they  had issues  with memory consumption )

Ken

Ken makes a great point. If you have remote firewalls - you might want to have a local location at site that you can store logs, which can be a simple Syslog server. From my understanding - if the firewall unit looses connection to FortiAnalyzer - once the connection is reestablished the logs would populate in FortiAnalyzer.

However, if you have network issues that hinder firewall units from communicating to FortiAnalyzer - I would say you have much bigger issues and gremlins in the system. 

[kidgradius]

I say use FortiAnalyzer. I have noticed on 100D and 600D the CPU spikes when browsing local logs; however, I have no experience with the 1000c.

You could also use syslog server to get RAW log items, which have not been massaged by FortiAnalyzer. I currently use LogRhythm, so that might be an option as well.