Log Forwarding from FortiNAC to SIEM Server with Facility Selection

[N_W]

I want to forward logs from FortiNAC to the SIEM server, but it only offers the option to select a single facility, and I'm not sure which one to choose. I want to view both when switches go down and authentication events. I'm attaching the details.

 

[AEK]

If I remember well I think it doesn't really matter, since the facility is to categorize the event. You can also use for example Local 1, 2, ... or 7 for your case.

[Sx11]

The default setting of "Security/Authorization" should fulfill your requirement.

Check this article for more details: https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-Syslog-messages-not-being-sent-to-sys...