Fortigate Syslog Timer

[olivern4]

Hi All,

I'm trying to find out how to configure our FG100D (6.2.14-FW-build1364-230411) to send to our Syslog Server (ELK) just every 5 mins. There is no option in the WebUI or even in the CLI to configure this. Is there any way to do this? All I can see is in the FortiAnalyzer option.

Thank you.

Oliver

[ozkanaltas · Accepted solution]

Hello @olivern4 ,

Syslog is an instant protocol, so unlike FortiAnalyzer, there is no store-and-forward option on the FortiGate.

[ozkanaltas · Accepted solution]

Hello @olivern4 ,

Syslog is an instant protocol, so unlike FortiAnalyzer, there is no store-and-forward option on the FortiGate.

[olivern4]

Hi @ozkanaltas 

Thank you for the response.

Meaning there is no way to do this? Okay. Can I just use the FortiAnalyzer option instead as the Syslog? I will just add the IP address of the ELK server right?

Thank you.

Oliver

[SonaMuvv · Accepted solution]

Hello Oliver,

You can get Fortianalyzer/Fortianalyzer cloud license and then configure that on the Fortigate to send logs to Fortianalyzer every 5 minutes.

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/712303/configuring-fortianal...

But you cannot use ELK server ip to configure Fortianalyzer, because when you configure Fortianalyzer it will be configured in the security fabric, which uses separate daemon/ports to forward logs to FortiAnalyzer.

[olivern4]

Hi @SonaMuvv 

Thank you.

Oliver