syslogd settings in FortiOS-5 not saving using cli

[mtcook01]

Hello all, I have a Fortigate 110c Firmware version 5 build 228 and cannot get the syslogd settings to save. I have used the following CLI commands config log syslogd setting set status enable set facility local7 set csv disable set server 192.168.2.100 (not real IP) set reliable disable end config log syslogd filter set severity debug set traffic enable set web enable set virus enable set attack enable end When I run a " show" on either command I only see this. ------------------------------------ config log syslogd setting show config log syslogd setting set status enable set server " 192.168.2.100" end ------------------------------------- config log syslogd filter show config log syslogd filter set severity debug end ------------------------------------- I even downloaded the config and cracked it open in wordpad. None of the other settings show there either. I had the same problem in the Version 5 build 208 firmware as well. Is this a bug or am I missing something?

[rwpatterson]

ORIGINAL: mtcook01 Well I take that back, now that I am actually on the computer (not remotely logged in) I can work with wireshark a bit more. I do see that syslog messages are being sent to the host. Neither IView or Kiwi seem to be able to decipher then. I changed the serial and IPs below, but there is the stream. 142 8.775821000 10.1.10.1 10.1.10.45 Syslog 526 LOCAL7.NOTICE: date=2013-08-13 time=12:04:25 devname=ESC-Primary devid=FG100C3G09690876 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=1921.2.109 srcport=62133 srcintf=" ESCMain" dstip=173.194.74.120 dstport=80 dstintf=" wan1" sessionid=6413 status=close policyid=3 dstcountry=" United States" srccountry=" Reserved" trandisp=snat transip=23.31.163.177 transport=62133 service=HTTP proto=6 applist=" block-p2p" duration=301 sentbyte=2713 rcvdbyte=1598 sentpkt=10 rcvdpkt=14

That looks more like browser traffic to me....

[Dave_Hall]

That looks more like browser traffic to me....

I think Mike is indicating that entire log event is the data stream itself to the syslog server.

[emnoc]

Is the output tab delimited ? maybe if the syslog can' t read the fields or is confused on the output format. What does wireshark show with the appropiate filter for syslog. syslog.msg I would start their and build a pcap and read it back in.

[mtcook01]

Hmm, not sure what you mean by build a pcap. I got the raw logs that our syslog server is receiving. This is directly from the software and not Wireshark date=2013-08-14 time=13:39:56 devname=ESC-Primary devid=FG100C3G045116649 logid=0001000014 type=traffic subtype=local level=notice vd=root srcip=192.1.2.4 srcport=5019 srcintf=" ESCMain" dstip=10.1.2.1 dstport=53 dstintf=" root" sessionid=1002625 status=accept policyid=0 dstcountry=" Reserved" srccountry=" Reserved" trandisp=noop service=DNS proto=17 app=" Domain Name Server" duration=181 sentbyte=0 rcvdbyte=135 sentpkt=0 rcvdpkt=1 The setup for that needs to be used for our software is local7, no csv, debug On a side note a 100A running FortiOS 4 mr 3 patch 9 is submitting data just fine.

[Dave_Hall]

Can you check to see if " set extended-traffic-log" is enabled under " config log syslogd filter" on both fgt devices? If you do not need this extra info that this settings provide then I say disable it.

[mtcook01]

That feature is available on the 100A but not on the 110C. Here are my filter settings Does not work with syslog ------------------------------------- set app-ctrl enable set attack enable set dlp enable set email enable set forward-traffic enable set local-traffic enable set netscan enable set severity debug set traffic enable set virus enable set voip enable set web enable set analytics enable set anomaly enable set app-ctrl-all enable set blocked enable set discovery enable set dlp-all enable set dlp-docsource enable set email-log-google enable set email-log-imap enable set email-log-msn enable set email-log-pop3 enable --More-- set email-log-smtp enable --More-- set email-log-yahoo enable --More-- set ftgd-wf-block enable --More-- set ftgd-wf-errors enable --More-- set infected enable --More-- set multicast-traffic enable --More-- set oversized enable --More-- set scanerror enable --More-- set signature enable --More-- set suspicious enable --More-- set switching-protocols enable --More-- set url-filter enable --More-- set vulnerability enable --More-- set web-content enable --More-- set web-filter-activex enable --More-- set web-filter-applet enable --More-- set web-filter-command-block enable --More-- set web-filter-cookie enable --More-- set web-filter-ftgd-quota enable --More-- set web-filter-ftgd-quota-counting enable --More-- set web-filter-ftgd-quota-expired enable --More-- set web-filter-script-other enable --More-- end ---------------------------------------------------------------- Here is the settings from my 100A which does work with syslog. ------------------------------------------------------------- set app-ctrl enable set attack enable set dlp enable set email enable set explicit-proxy-traffic enable set failed-connection enable unset override set severity debug set traffic enable set virus enable set wanopt-traffic enable set web enable set webcache-traffic enable set allowed enable set anomaly enable set app-ctrl-all enable set blocked enable set dlp-all enable set email-log-imap enable set email-log-msn enable set email-log-pop3 enable set email-log-smtp enable set email-log-yahoo enable --More-- set extended-traffic-log enable --More-- set ftgd-wf-block enable --More-- set ftgd-wf-errors enable --More-- set infected enable --More-- set oversized enable --More-- set scanerror enable --More-- set signature enable --More-- set url-filter enable --More-- set violation enable --More-- set web-content enable --More-- set web-filter-activex enable --More-- set web-filter-applet enable --More-- set web-filter-cookie enable --More-- set web-filter-ftgd-quota enable --More-- set web-filter-ftgd-quota-counting enable --More-- set web-filter-ftgd-quota-expired enable --More-- set web-filter-script-other enable --More-- end ----------------------------------------------------------- Thanks again

[Dave_Hall]

Diff (Does not work with syslog)...

 set forward-traffic enable
 set local-traffic enable
 set netscan enable
 set voip enable
 set analytics enable
 set discovery enable
 set dlp-docsource enable
 set email-log-google enable
 set multicast-traffic enable
 set suspicious enable
 set switching-protocols enable
 set vulnerability enable
 set web-filter-command-block enable

Diff (works on 100A)...

 set explicit-proxy-traffic enable
 set failed-connection enable
 unset override
 set wanopt-traffic enable
 set webcache-traffic enable
 set allowed enable
 set extended-traffic-log enable
 set violation enable

Personally, if I had a spare 110C unit or can afford some down time, I' d just make a backup of the config and perform " exec factoryreset" on the 110C (or spare unit) then set up syslogd logging on a " clean" config. If that works then save that config and restore the old one. Compare the diff between the two configs.

[mtcook01]

Thanks everyone for your help. I don' t have a spare and this is my last Fortigate purchase. The " forward traffic" logs no longer work with the most recent firmware upgrade. I do wish FG would conduct better QA. I might take this down over the weekend and rebuild the config. Again thank you for your help.

[GembuL]

just enable logs on memory even your fortigate device has a hard drive as storage. and log will be appear on your syslog.