Unable to LOG anything to a syslog server

[#1]

Hello, I' m getting mad. I' m unable to send any log messages to a syslog server installed in a PC. The syslog server works, but the Fortigate doesn' t send anything to it. It' s a Fortigate 200B, firm 4.0 build 0178 (MR1). I think everything is configured as it should, interfaces are set log enable, and policy rules I would like to log are log allowed. But it doesn' t work. I' m getting mad. Do I need to reset the firewall after configure logging ? Can I restart log service only ? Firmware bug ? Thanks

[SECCON1MC]

I have seen in the past where a reboot is needed to get logs rolling through syslog or FAZ after adjustments have been made. Try killing the logging process via the CLI or just reboot the box.

[#3]

That' s a good idea, but could you tell me how to kill the log service and restart it from the CLI ? I have no idea how to do it

[SECCON1MC]

from the CLI -

diag sys top

output looks something like this -

Run Time: 1 days, 5 hours and 28 minutes 0U, 0S, 99I; 249T, 107F, 75KF newcli 18431 R 0.1 5.0 sshd 18414 S 0.1 4.0 httpsd 59 S 0.0 6.9 httpsd 16043 S 0.0 6.9 cmdbsvr 17 S 0.0 6.1 httpsd 29 S 0.0 5.7 newcli 18426 S 0.0 5.0 ipsengine 49 S < 0.0 4.7 miglogd 27 S 0.0 4.6 scanunitd 28236 S < 0.0 4.4 merged_daemons 43 S 0.0 4.3 fdsmgmtd 58 S 0.0 4.2 iked 56 S 0.0 4.1 thttp 47 S 0.0 4.1 scanunitd 28231 S < 0.0 4.1 updated 57 S 0.0 4.1 authd 51 S 0.0 4.0 snmpd 60 S 0.0 4.0 dhcpd 61 S 0.0 4.0

identify the process ID for the logging subsystem (miglogd), in this case 27 Kill the process

diag sys kill 9 <process id>

The watchdog daemon will restart the process. Check to make sure logs are flowing via some packet sniffing

diag sniffer packet any ' port 514'  4
 

[#5]

Thanks, I can see it' s similar as Linux process. Watchdog started again syslog daemon , but still no packets received at syslogd server. A packet sniffing show this once and once again: interfaces=[any] filters=[port 514] 5.210139 192.168.100.1.24678 -> 192.168.100.21.514: syn 3924309279 5.210148 192.168.100.1.24678 -> 192.168.100.21.514: syn 3924309279 5.210348 192.168.100.21.514 -> 192.168.100.1.24678: rst 0 ack 3924309280 192.168.100.1 is Fortinet and 100.21 is syslogd server. Is this good or bad ? Thanks

[abelio]

hummm... your syslog at 100.21 is resetting connections. 5.210348 192.168.100.21.514 -> 192.168.100.1.24678: rst 0 ack Re-check firewalling rules within that linux box

[jmac]

Your packet sniff shows SYN packets to 514, which means it' s TCP, not UDP. 514/tcp is used by FortiGate to communciate with FortiAnalyzer. 514/udp is syslog. http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=10773

[SECCON1MC]

jmac - You are right on. That is the FortiGate trying to speak " FortiAnalyzer" talk. 514 tcp - is used for information like that nice green check mark, quota and storage info, FAZ log access, etc. You will also see 514 udp when using a FAZ as well. Let' s tripple check everything is setup for use with a sysog server. -Matt

[#9]

Ok, it works now I disabled " reliable" feature, maybe reliable makes the communication using TCP instead of UDP, but I remember I tested some days ago with and without realiable and nothing worked, but now it works. Thank you very much to all of you