VDOM logging

[Phil_G]

Hi, We are currently using a Fortigate 3140B firewall (single-domain mode) and want to enable VDOMs to provision a new environment. There is some confusion within our organisation about whether or not you can configure different SYSLOG servers per-VDOM or not. Ideally we would like VDOM 1 to log to SYSLOG server A, and VDOM 2 to log to a different SYSLOG server B. IS this possible? Our ' experts' tell me that you can only log to the same set of SYSLOG servers configured in the management VDOM and would need to do some parsing of the logfiles to filter per-VDOM on the log servers. This seems antiquated and quite frankly has to be incorrect info. In addition they are telling me that the move from a single-domain mode to a multi-VDOM mode is very disruptive and could not be done on a production firewall without major impact. This sounds more likely but would be interested for feedback from others who have done this - how long did it take? How much downtime was experienced moving from single to multi-mode? Many thanks in advance Phil

[emnoc]

Q1; you have support for per VDOM logging, iirc you have to enable and override this from the CLI. I' m sure some one would correct if I' m wrong. Q2: No this is not correct, if you enable vdom on a production Fortigate, the worst it will make you do is to; logout and log back in. As with any changes, you want to backup the configuration b4 enabling vdom. All interfaces per default are in root-vdom and enable mult-vdom does NOT change this.

[DW_FTNT]

logging per vdom is now a feature in 6.2

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/972129/multiple-fortianalyzer-or-sys...