Hi,
My FortiAnalyser is creaking with too many logs being generated per day. We have "all logging" turned on a lot of policies which we can probably reduce to UTM logs only - but I'd like to have a report of which policies are creating the most amount of logs so I can target them first.
Is there a report a a view I can enable to see which policies are generating the most amount of logs?
-------------------------------------------------
Tom Whiteley Infrastructure Engineer
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
What I would do
1: if you have multiple FGT logging check the log per/sec per fgt
2: Tackle the easy stuff ( do you log all dns lookup, CIFS/SMB internal traffic, MS-AD traffic, etc...)'
3: Do you log session start
I was in your shoes a year or two ago with a ORG that believed "log all" an everything was the smart ideal. Upper
management and CISO had no clue about what we logged and how to use and effective logging solution.
PCNSE
NSE
StrongSwan
If you don't have too many FortiGates or too many different security policies, you can just filter a days worth of logs by log UUID or log custom field and see how many you get for each policy.
See http://socpuppet.blogspot.com/2017/06/fortios-logging-uuid.html for details on log UUID.
See http://socpuppet.blogspot.com/2017/07/custom-log-fields-fortios.html for details on setting custom field for particular policies.
I agree that a report from the FAZ for this sort of thing would be very useful, so if you come up with a solution please post it! Quickest solution might be gotten by giving TAC a call.
I agreed, look at the top policies and how many hits over a 1/2 day period during the week would be a start. Advise log with you need, and is useful.
Ken
PCNSE
NSE
StrongSwan
Thanks for all the replies. I have logged it with our support vendor who I've asked to raise with FortiNet (I'll log it directly if they don't but I have to jump through these hoops).
I have done a quick look at our biggest hitting policies on the FortiGates (we only have 2x HA pairs) - and looked for ones that have the largest number of hits and where Logging is enabled. I'll start with them.
I'm still going to look into the report option because it saves increasing our log licence, which is probably why it's not included out of the box ;)
-------------------------------------------------
Tom Whiteley Infrastructure Engineer
So what we did during my last big audit
1: we ID all policy with logging set for policy
e.g
show firewall policy | grep -f "set logging all"
2: review each policy for hits
diagnose firewall iprope show 100004
3: and then tackle the one that has most hits per hour or day
I also do the above on a regular schedule to ID policies that are no longer used or have changed ( if the hits counts do not increase, that's a good chance the traffic has changed or policy, or is not no longer required )
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1528 | |
1020 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.