Logging on the disk AND to a remote syslog at the same time, possible?

[scheuri]

Hello everyone

I have two virtual Fortigates (one in Azure, one on ESXi). Both of them have local disks and both are configured to send the logs to a Fortianalyzer. Both Fortigates are on 6.4.9.

When enabling disk logging (config log disk setting - set status enable) nothing changes - I get the logs to the Fortianalyzer, but I don't have any local logs.

Is that a bug or is this intended? Can't I have the same logs on both, local and send remotly?

Thanks for your input

Best regards

scheuri

[abarushka]

Hello,

It should be possible to log to disk and FortiAnalyzer simultaneously.

Please make sure that you select disk in the logging section (top right corner next to details), alternatively you may consider to view disk logs in CLI:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Displaying-logs-via-FortiGate-s-CLI/ta-p/1...

[gfleming]

On top of abarushka's excellent suggestion are you sure the VMs have a log disk configured? It would be datadrive.vmdk for the ESXi deployment.