Logic to send logs from EMS to FortiAnalyzer

[ismailurek2]

Hi Fortinet Community,

When I try to get logs to FortiAnalyzer via EMS and ems endpoints, I see that the endpoint sends logs directly to FortiAnalyzer.

Logically I thought that it sends it to the analyzer on the EMS, but I realized that this is not the case.

How exactly does FortiAnalyzer and FortiClient EMS log collection logic work?

Best Regards,

İsmail Ürek

[AEK]

Hi Ismail

For EMS you configure it in the "Log Settings".

For the client you configure it from on the "System Settings" endpoint profile.