Unusual field usage in syslog records.

[eager2learn]

We use a Fortigate 200D with Firmwarw v.5.4.3,build1111(GA)

In "Log & Report", "Log Settings", "Remote Logging and Archiving"

"Send Logs to Syslog" is set on.

IP Address/FQDN: (is filled with the IP-address of a Graylog server.)

"Local Traffic Log" is set off.

"Event Logging" is set on

All event are set on.

The Graylog server receives the syslog records from the Fortigate.

But the format of the syslog records is unusual.

In the syslog record field "source" we expect the hostname of the Fortigate but the content is "date=2019-04-11".

Is this caused by a wrong setting?

Can we change this?

Or is this a bug?

[Alivo__FTNT]

Hello, Could you paste here the whole log?

Alivo

[eager2learn]

Do you need one syslog record send by the Fortigate? Can the Fortigate deliver this syslog record?

Or shall I let wireshark capture a syslog record of the fortigate?

[eager2learn]

With tcpdump I got a log message from the Fortigate to the Graylog-server.

Msg: date=2019-04-15 time=16:15:33 devname=FG200D-Mailstreet devid=FG200D3916815285 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=192.168.0.226 srcname="AUTOMATION-TEST" srcport=55416 srcintf="lag-trust" dstip=192.168.10.16 dstport=61953 dstintf="lag-dmz" poluuid=a599932a-defa-51e6-46df-62c214fc6a99 sessionid=1546271439 proto=6 action=close policyid=10029 policytype=policy dstcountry="Reserved" srccountry="Reserved" trandisp=noop service="tcp/61953" duration=2 sentbyte=240 rcvdbyte=200 sentpkt=5 rcvdpkt=4 appcat="unscanned" devtype="Windows PC" osname="Windows" osversion="7 or 8" mastersrcmac=00:50:56:b6:e1:63 srcmac=00:50:56:b6:e1:63

A Ubuntu Linux system send the message below to the Graylog-server:

Msg: 1 2019-04-15T17:14:13.334327+02:00 test02 sshd 18557 - -  pam_unix(sshd:session): session opened for user eager2learn by (uid=0)\0x0a

Graylog recognizes the syslog message from the Ubuntu Linux system and use "test02" as system name.

On the Ubuntu Linux system I set "RSYSLOG_SyslogProtocol23Format".

It seems that the Fortigate use another SyslogProtocol Format.

Graylog use "date=2019-05-15" as system name for the message from the Fortigate.

[Frosty]

Haven't used Graylog, however we syslog from FG200E to ManageEngine Event Log Analyzer and it works okay. 

But I had to specify the "type" of the syslog format in Event Log Analyzer at the receiving end, so chose simply "Unix" as the type ... and it worked.

I assume you've read through this:  http://docs.graylog.org/en/3.0/pages/sending_data.html