Logging to external USB disk

[TechBC]

Hello there I have F60C v4.0,build5849,110804 (MR2) I noticed that there is the USB port to load configuration or to backup configuration. Could you please tell me if I can attach an external USB disk to increase details and size of logs and reports? TIA

[nicolez]

Hello TIA! Logging to external USB devices is not possible. In an old V3 firmware there was an option to log to external network devices, but this option has gone very fast again. For your box, there is no v3 firmware. If you need more logging capacity you should think about an Analyzer or FAMS. Syslog would be the cheapest option, but then you have to crate your reports at your own. In fact, please upgrade the 60c. You are using an interims build of firmware....using an official version would be better. The 60c is running much better with the latest one 4 MR3 P5. best Regards, Nicole

[mbrowndcm]

Syslog should be fine with a solution search-engine like solution. I' m looking into Splunk with the free license right now and it is very easy to create reports with syslog data.

[SYQUEST]

I find that interesting, one of my clients has an FG60C with FW 4.2.8. I installed an 8GB flash drive to the USB port, then setup file logging space for the various log types. I just recently had an event that the log file was 75% full, so I increased the allotted space to handle more traffic. In the webui traffic and event windows it also gives you the option to view memory buffer or disk. So unless I am dreaming, FW 4.2.8 lets you log to external disk! Are we discussing the same thing or something else? ....JIM....

[bbache99]

Hi Jim, I am trying to do exactly this on a 60B but cannot see anywhere in the GUI a place to enable logging to an external drive. Could you please explain how you achieved this on a 60C? Thanks, Ben

[Carl_Wallmark]

I find that interesting, one of my clients has an FG60C with FW 4.2.8. I installed an 8GB flash drive to the USB port, then setup file logging space for the various log types. I just recently had an event that the log file was 75% full, so I increased the allotted space to handle more traffic. In the webui traffic and event windows it also gives you the option to view memory buffer or disk. So unless I am dreaming, FW 4.2.8 lets you log to external disk!

The FortiGate 60C has 8 GB of flash memory, and is called " Disk" in the GUI, i bet its that you see.

[SYQUEST]

If that is the case, why would Fortinet provide USB Disk formatting capability on the devices that have USB jacks? I have included a screen shot of the page that shows the disk allotment. In the Administration Guide for Version 4.0MR2 see formatting USB Disks on page 198. I will have to do further evaluation of the USB flash disk to see if it actually has any other files on it besides the configuration backup file. I guess that would provide more proof one way or the other. If you can' t put the logging files on a USB flash disk, why have flash disk capability??? I have an FG60B too, but I need to update the firmware to 4.2.8 or later and try the USB disk on it and see what happens... ....JIM....

[Carl_Wallmark]

Thats because USB drives are used for storing configuration and firmware, nothing else. The flash on your screenshot is the built-in " disk" on the 60C.

[GertVdJ]

Hi Carl,

I saw your (old/2012) answer on this Q.

Can external USB disks still be used for config/firmware only?

Even in 2022 and with FortiOS 7.*?

Tia.

Gert

[alirezaahmadieyni]

Hi everyone,

I have a FortiGate 100F. I don’t have access to a FortiAnalyzer, but I would like to store logs locally on the FortiGate so that I can use the built-in widgets and log/report views in the GUI.

• Is it possible to keep logs directly on the FortiGate (either on disk or memory) without an Analyzer?

• If yes, what are the limitations (for example: storage size, log retention, reports)?

Any advice or best practices would be appreciated.

Thanks in advance!