syslogd settings in FortiOS-5 not saving using cli

[mtcook01]

Hello all, I have a Fortigate 110c Firmware version 5 build 228 and cannot get the syslogd settings to save. I have used the following CLI commands config log syslogd setting set status enable set facility local7 set csv disable set server 192.168.2.100 (not real IP) set reliable disable end config log syslogd filter set severity debug set traffic enable set web enable set virus enable set attack enable end When I run a " show" on either command I only see this. ------------------------------------ config log syslogd setting show config log syslogd setting set status enable set server " 192.168.2.100" end ------------------------------------- config log syslogd filter show config log syslogd filter set severity debug end ------------------------------------- I even downloaded the config and cracked it open in wordpad. None of the other settings show there either. I had the same problem in the Version 5 build 208 firmware as well. Is this a bug or am I missing something?

[Dave_Hall]

Is this a bug or am I missing something?

The fgt doesn' t show the factory default values for settings -- if you want to see those default values, use " show full-configuration" . edit: at least I am assuming that' s what your issue is (i.e. setting default values to their default equates to no change at all). If that' s not your issue then you could try adding those missing lines via wordpad then load that edited config into the fgt.

[mtcook01]

That command show full-configuration does work. Although it does not solve my original problem. My settings are indeed saved but apparently the syslog format has changed and my CyberRoam Iview no longer understands it. I contacted their support and after an exhausting 2 hours of remote work they concluded the problem lies with my update to FortiOS 5. Which overall has been a buggy nightmare. Does anyone know or understand the changes to the syslog stream from version 4 to 5?

[mtcook01]

I have tried this with KIWI syslog as well and no dice. I can' t seem to get any syslog servers to work. Any help would be much appreciated.

[rwpatterson]

Have you run a sniffer trace from the FGT filtering on the destination IP address?

[Dave_Hall]

Does anyone know or understand the changes to the syslog stream from version 4 to 5?

Actually researched this for a bit -- only real changes I can see is from both 4.3 MR3 and 5.0. handbooks...4.3 MR3 wants you to set the server address while 5.0 wants you to set the source-ip address.

[mtcook01]

I will try both of those. Let me run a Wireshark sniff and see if I can see the data.

[mtcook01]

David, I did see that excerpt from a previous poster when researching this as well. I have put about 20 hours into this between researching and combing through documentation. I appreciate you all taking the time to help out. I did put a wireshark sniffer on the host machine and see no traffic going to the UDP 514, which probably explains the problem. I do however see other UDP traffic moving to the host fine. All firewalls are off and snmp traps are being received. Here is my config, ip has been changed for security. config log syslogd setting set status enable set server " 192.1.10.45" (host running syslog) set reliable disable set port 514 set csv disable set facility local7 set source-ip 192.1.10.1 (this is the fortigate interface) end config log syslogd filter set app-ctrl enable set attack enable set dlp enable set email enable set forward-traffic enable set local-traffic enable set netscan enable set severity debug set traffic enable set virus enable set voip enable set web enable set analytics enable set anomaly enable set app-ctrl-all enable set blocked enable set discovery enable set dlp-all enable set dlp-docsource enable set email-log-google enable set email-log-imap enable set email-log-msn enable set email-log-pop3 enable --More-- set email-log-smtp enable --More-- set email-log-yahoo enable --More-- set ftgd-wf-block enable --More-- set ftgd-wf-errors enable --More-- set infected enable --More-- set multicast-traffic enable --More-- set oversized enable --More-- set scanerror enable --More-- set signature enable --More-- set suspicious enable --More-- set switching-protocols enable --More-- set url-filter enable --More-- set vulnerability enable --More-- set web-content enable --More-- set web-filter-activex enable --More-- set web-filter-applet enable --More-- set web-filter-command-block enable --More-- set web-filter-cookie enable --More-- set web-filter-ftgd-quota enable --More-- set web-filter-ftgd-quota-counting enable --More-- set web-filter-ftgd-quota-expired enable --More-- set web-filter-script-other enable --More-- end Really any help would be a lifesaver. ----------------------------- Update- I installed wireshark on another machine with KiwiSyslog server, configured the " server ip" on the fortigate and still no UPD 514 traffic at all in the logs. Thanks again.

[rwpatterson]

What traffic does the FGT say is going to the host? This may give you your answer.

Diag sniffer packet <interface> ' host=x.x.x.x' 

[mtcook01]

Well I take that back, now that I am actually on the computer (not remotely logged in) I can work with wireshark a bit more. I do see that syslog messages are being sent to the host. Neither IView or Kiwi seem to be able to decipher then. I changed the serial and IPs below, but there is the stream. 142 8.775821000 10.1.10.1 10.1.10.45 Syslog 526 LOCAL7.NOTICE: date=2013-08-13 time=12:04:25 devname=ESC-Primary devid=FG100C3G09690876 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=1921.2.109 srcport=62133 srcintf=" ESCMain" dstip=173.194.74.120 dstport=80 dstintf=" wan1" sessionid=6413 status=close policyid=3 dstcountry=" United States" srccountry=" Reserved" trandisp=snat transip=23.31.163.177 transport=62133 service=HTTP proto=6 applist=" block-p2p" duration=301 sentbyte=2713 rcvdbyte=1598 sentpkt=10 rcvdpkt=14