How to change particular event's syslog severity change

[shkang1]

Hi,

I have a question about change of syslog severity.

For example, If interface status changes, severity level is warning.

However when the above situation occurs, I want to change the severity level to information.

How can I change particular event's severity level?

My fortigate's version is 7.2.4v.

Regards,

[srajeswaran]

We cannot change the severity of eventlogs, they are predefined. Any particular reason for changing the severity? We can use filters to skip sending certain logs to the syslog server/Fortianalyzer using filters under syslog config>

config log memory filter
set filter "logid xxxxx" -> Please use the log ID from the event log
set filter-type exclude
end

config log fortianalyzer filter
config free-style
edit 1
set category event
set filter "logid xxxxx" -> Please use the log ID from the event log
set filter-type exclude
next
end
end

[josip]

Hello Suraj

Yes, this is important. 

Let's say you want to reduce the amount of logs by using the severity "notification" instead of "information".

Now you need to monitor Admin logins in SIEM.

Failed Admin logins have the the log ID 0100032002 and are part of the severity "alert" while successful Admin login logs will not be forwarded to the log collector, because this event is in the severity "information". But it could be a useful information in SIEM to correlate security events. That's why it's necessary, that you can put the log id 0100032001 (Admin logon OK) into the severity "notification". And that would simplify the config.

The next problem is this for example. The event ID 0100032002 has a default severity "alert", but for us it could have just the severity "notification", because the circumstances are allowing that. It reduces the flexibility of how events could be proceeded.