Maximum message length for FortiSiem

[alp]

Hi everyone,

Is there a limitation about a syslog message's length or size in FortiSiem? If there is, how can I change it?

[Anthony_E]

Hello alp,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello alp,

I have found this documentation. Check page 87:

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/02e00da1-7cee-11e9-81a4-005056...

Tell me if it helped.

Regards,

[premchanderr]

Hi @alp , 

Fortisiem can receive Syslog event messages of various sizes, but all Appliances are configured with a default maximum event size.

Messages that are larger than the maximum size of the RFC specification for the TCP and UDP protocol have their event payloads truncated to ensure that Fortisiem can receive the event.
Maximum event size by protocol:
UDP syslog messages should not exceed 1024 bytes
TCP syslog messages should not exceed 8192 bytes.

There is no minimum length for the syslog message. Overall performance would be affected if the syslog size limit is increased, more data sent through, more resources needed to process.

Unfortunately, there is no settings on Fortisiem that can allow to increase size of the packet. If you want to increase the size limit, you need to raise a feature request.

[bhinangt]

How to increase the size as seeing Truncated Message in AWS Logs!

[premchanderr]

Hi @bhinangt ,

This is by design of linux server and from FortiSIEM we cannot provide recommendation on increasing the size.  If the message length is too long, then do check the logging level and review if  you are receiving only useful information.