Hi everyone,
Is there a limitation about a syslog message's length or size in FortiSiem? If there is, how can I change it?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello alp,
Thank you for using the Community Forum.
I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Regards,
Hello alp,
I have found this documentation. Check page 87:
Tell me if it helped.
Regards,
Hi @alp ,
Fortisiem can receive Syslog event messages of various sizes, but all Appliances are configured with a default maximum event size.
Messages that are larger than the maximum size of the RFC specification for the TCP and UDP protocol have their event payloads truncated to ensure that Fortisiem can receive the event.
Maximum event size by protocol:
UDP syslog messages should not exceed 1024 bytes
TCP syslog messages should not exceed 8192 bytes.
There is no minimum length for the syslog message. Overall performance would be affected if the syslog size limit is increased, more data sent through, more resources needed to process.
Unfortunately, there is no settings on Fortisiem that can allow to increase size of the packet. If you want to increase the size limit, you need to raise a feature request.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1560 | |
1034 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.