THE LOGS NOT RECEIVED

[MOHAMMAD_ALAVI]

Dear guys, i' ve installed a FAL VM (with trial license) in order to evaluate it . i' ve set my FG to connect to FAL and it' s done successfully. and in FAL devices i can see the FG . but when i try to send the logs to FAL, i encounter with the message THE LOGS NOT RECEIVED . someone help me

[CorneJvV]

Are you have any VDOM' s enabled ? If yes, make sure about Static Routes and VDOM Links. I had the same issue a while ago, but I can' t remember how I solved it. It was something basic that I overlooked (all I can remember).

[Dave_Hall]

Make sure the fgt device privileges are set correctly in the FA.

[MOHAMMAD_ALAVI]

The VDOM feature is disabled in FG ... And about the privileges, all of them has selected ...

[Dave_Hall]

Go into the event log (on the fgt) and confirm there are events showing. If not, you may need to reformat the logging device. Next, in the Log&Report->Log Setting->Upload logs remotely->FortiAnalyzer->click the Test Connectivity button -- tell us what the Connection Summary says.

[MOHAMMAD_ALAVI]

Dear guys, i' m a FCNSA and FCNSP certified ... so i' ve done every advanced diagnosis you might think of . so just advise me some advanced tshoot ... i know the basic of joining a FortiAnalyzer with a FG

[CorneJvV]

I had the same issues about five months ago with a new appliance in our environment. I can' t remember what the solution was, but I do remember looking at it and thinking to myself, what a basic thing that was overlooked.

[MOHAMMAD_ALAVI]

Well i' m sure that i' ve done every basic step and also i' ve checked the Test connectivity on the FG and all the fields was ok except the LOGS status which showed " LOGS NOT RECEIVED " . so i thought that maybe something blocking the traffic . as you know the FG and FAL uses Syslog protocol and port 514 in order to sending and receiving logs . i' ve checked the session on FAL and realized that FG has initiated a session to FAL with mentioned port ... even i ' ve captured the traffic on FG and analyzed it with WIRESHARK and it seemed that the FG sending the correct traffic and i' ve found it checking the HEX section of traffic . that is all i' ve done .

[Fullmoon]

Do this under fortigate device. FWFXXX# config log fortianalyzer setting FWF6XXX(setting) # set upload-option realtime FWFXXX (setting) # end good luck :)

[MOHAMMAD_ALAVI]

As i said , it' s already set on realtime . i have tried both mode and the issue is exist as before