Fortinet black logo

CLI Reference

config log setting remote

config log setting remote

Use this command to configure logging to a remote syslog server.

Note

To configure from global, see config log setting global_remote. Global has preset configurations that users may use for easy configuration, which apply to all VDOMs. However, in config log setting remote, the user can customize the configuration for the individual VDOM, overriding the global remote config.

You can enable override_global_remote here:

FortiADC-VM (root) # config log setting general

FortiADC-VM (general) # show full-configuration

config log setting general

set override_global_remote enable

end

A remote syslog server is a system provisioned specifically to collect logs for long term storage and analysis with preferred analytic tools.

Before you begin:
  • You must have read-write permission for log settings.

Syntax

config log setting remote

edit <name>

set attack-log-status {enable|disable}

set attack-log-category {av|ddos|geo|ipreputation|ips|waf|fw|ztna}

set comma-separated-value {enable|disable}

set event-log-status {enable|disable}

set event-log-category {admin|configuration|fw|glb|health-check|llb|slb|system|user}

set facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0, local1, local2, local3, local4, local5, local6, local7, lpr, mail, news, ntp}

set loglevel {alert|critical|debug|emergency|error|information|notification|warning}

set proto [udp|tcp|tcpssl]

set tcp_framing {traditional|octet_counted}

set port <integer>

set server <string>

set status {enable|disable}

set traffic-log-status {enable|disable}

set traffic-log-category {slb|dns|llb}

next

end

attack-log-status

Enable/disable logging for security events.

attack-log-category

If attack-log-status is enabled, the attack-log-category becomes configurable.

Select one or more of the following security categories to include in the security logs export:

  • ddos — DoS protection logs.
  • ipreputation — IP Reputation logs.
  • waf — WAF logs.
  • geo — Geo IP blocking logs.
  • av — AV logs.
  • ips — IPS logs.
  • fw — Firewall logs.
  • ztna — ZTNA logs.

comma-separated-value

Send logs in CSV format. Do not use with FortiAnalyzer.

event-log-status

Enable/disable logging for system events.

event-log-category

If event-log-status is enabled, the event-log-category becomes configurable.

Select one or more of the following event categories to include in the event logs export:

  • configuration — Configuration changes.
  • admin — Administrator actions.
  • system — System operations, warnings, and errors.
  • user — Authentication results logs.
  • health-check — Health check results and client certificate validation check results.
  • slb — Notifications, such as connection limit reached.
  • llb — Notifications, such as bandwidth thresholds reached.
  • glb — Notifications, such as the status of associated local SLB and virtual servers.
  • fw — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

facility

Identifier that is not used by any other device on your network when sending logs to FortiAnalyzer/syslog.

loglevel

Select the lowest severity to log from the following options:

  • emergency — The system has become unstable.
  • alert — Immediate action is required.
  • critical — Functionality is affected.
  • error — An error condition exists and functionality could be affected.
  • warning — Functionality might be affected.
  • notification — Information about normal events.
  • information — General information about system operations.
  • debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

The exported logs will include the selected severity level and above. For example, if you select error, the system collects logs with severity level error, critical, alert, and emergency. If you select alert, the system collects logs with severity level alert and emergency.

port

Listening port number of the syslog server. Usually this is UDP/TCP/TCPSSL port 514.

server

IP address of the syslog server.

status

Enable/disable the configuration.

proto

Use protocol to transfer log messages.

tcp_framing

The frame in which the log message is stored in tcp/tcpssl packets.

traffic-log-status

Enable/disable logging for traffic processed by the load balancing modules.

traffic-log-category

If traffic-log-status is enabled, the traffic-log-category becomes configurable.

Select one or more of the following traffic categories to include in the traffic logs export:

  • slb — Server Load Balancing traffic logs related to sessions and throughput.
  • dns — Global Load Balancing traffic logs related to DNS requests.
  • llb — Link Load Balancing traffic logs related to session and throughput.

Example

FortiADC-VM # config log setting remote

FortiADC-VM (remote) # edit 1

Add new entry '1' for node 547

FortiADC-VM (1) # get

status : disable

server : 0.0.0.0

port : 514

loglevel : information

comma-separated-value : disable

facility : kern

event-log-status : disable

traffic-log-status : disable

attack-log-status : disable

FortiADC-VM (1) # set status enable

FortiADC-VM (1) # set server 203.0.113.10

FortiADC-VM (1) # set loglevel notification

FortiADC-VM (1) # set event-log-status enable

FortiADC-VM (1) # set event-log-category admin configuration system

FortiADC-VM (1) # set traffic-log-status enable

FortiADC-VM (1) # set traffic-log-category slb dns llb

FortiADC-VM (1) # end

FortiADC-VM # get log setting remote

== [ 1 ]

status: enable

server: 203.0.113.10

port: 514

loglevel: notification

facility: kern

FortiADC-VM # show log setting remote

config log setting remote

edit 1

set status enable

set server 203.0.113.10

set loglevel notification

set event-log-status enable

set event-log-category configuration admin system

set traffic-log-status enable

set traffic-log-category slb dns llb

next

end

config log setting remote

config log setting remote

Use this command to configure logging to a remote syslog server.

Note

To configure from global, see config log setting global_remote. Global has preset configurations that users may use for easy configuration, which apply to all VDOMs. However, in config log setting remote, the user can customize the configuration for the individual VDOM, overriding the global remote config.

You can enable override_global_remote here:

FortiADC-VM (root) # config log setting general

FortiADC-VM (general) # show full-configuration

config log setting general

set override_global_remote enable

end

A remote syslog server is a system provisioned specifically to collect logs for long term storage and analysis with preferred analytic tools.

Before you begin:
  • You must have read-write permission for log settings.

Syntax

config log setting remote

edit <name>

set attack-log-status {enable|disable}

set attack-log-category {av|ddos|geo|ipreputation|ips|waf|fw|ztna}

set comma-separated-value {enable|disable}

set event-log-status {enable|disable}

set event-log-category {admin|configuration|fw|glb|health-check|llb|slb|system|user}

set facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0, local1, local2, local3, local4, local5, local6, local7, lpr, mail, news, ntp}

set loglevel {alert|critical|debug|emergency|error|information|notification|warning}

set proto [udp|tcp|tcpssl]

set tcp_framing {traditional|octet_counted}

set port <integer>

set server <string>

set status {enable|disable}

set traffic-log-status {enable|disable}

set traffic-log-category {slb|dns|llb}

next

end

attack-log-status

Enable/disable logging for security events.

attack-log-category

If attack-log-status is enabled, the attack-log-category becomes configurable.

Select one or more of the following security categories to include in the security logs export:

  • ddos — DoS protection logs.
  • ipreputation — IP Reputation logs.
  • waf — WAF logs.
  • geo — Geo IP blocking logs.
  • av — AV logs.
  • ips — IPS logs.
  • fw — Firewall logs.
  • ztna — ZTNA logs.

comma-separated-value

Send logs in CSV format. Do not use with FortiAnalyzer.

event-log-status

Enable/disable logging for system events.

event-log-category

If event-log-status is enabled, the event-log-category becomes configurable.

Select one or more of the following event categories to include in the event logs export:

  • configuration — Configuration changes.
  • admin — Administrator actions.
  • system — System operations, warnings, and errors.
  • user — Authentication results logs.
  • health-check — Health check results and client certificate validation check results.
  • slb — Notifications, such as connection limit reached.
  • llb — Notifications, such as bandwidth thresholds reached.
  • glb — Notifications, such as the status of associated local SLB and virtual servers.
  • fw — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

facility

Identifier that is not used by any other device on your network when sending logs to FortiAnalyzer/syslog.

loglevel

Select the lowest severity to log from the following options:

  • emergency — The system has become unstable.
  • alert — Immediate action is required.
  • critical — Functionality is affected.
  • error — An error condition exists and functionality could be affected.
  • warning — Functionality might be affected.
  • notification — Information about normal events.
  • information — General information about system operations.
  • debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

The exported logs will include the selected severity level and above. For example, if you select error, the system collects logs with severity level error, critical, alert, and emergency. If you select alert, the system collects logs with severity level alert and emergency.

port

Listening port number of the syslog server. Usually this is UDP/TCP/TCPSSL port 514.

server

IP address of the syslog server.

status

Enable/disable the configuration.

proto

Use protocol to transfer log messages.

tcp_framing

The frame in which the log message is stored in tcp/tcpssl packets.

traffic-log-status

Enable/disable logging for traffic processed by the load balancing modules.

traffic-log-category

If traffic-log-status is enabled, the traffic-log-category becomes configurable.

Select one or more of the following traffic categories to include in the traffic logs export:

  • slb — Server Load Balancing traffic logs related to sessions and throughput.
  • dns — Global Load Balancing traffic logs related to DNS requests.
  • llb — Link Load Balancing traffic logs related to session and throughput.

Example

FortiADC-VM # config log setting remote

FortiADC-VM (remote) # edit 1

Add new entry '1' for node 547

FortiADC-VM (1) # get

status : disable

server : 0.0.0.0

port : 514

loglevel : information

comma-separated-value : disable

facility : kern

event-log-status : disable

traffic-log-status : disable

attack-log-status : disable

FortiADC-VM (1) # set status enable

FortiADC-VM (1) # set server 203.0.113.10

FortiADC-VM (1) # set loglevel notification

FortiADC-VM (1) # set event-log-status enable

FortiADC-VM (1) # set event-log-category admin configuration system

FortiADC-VM (1) # set traffic-log-status enable

FortiADC-VM (1) # set traffic-log-category slb dns llb

FortiADC-VM (1) # end

FortiADC-VM # get log setting remote

== [ 1 ]

status: enable

server: 203.0.113.10

port: 514

loglevel: notification

facility: kern

FortiADC-VM # show log setting remote

config log setting remote

edit 1

set status enable

set server 203.0.113.10

set loglevel notification

set event-log-status enable

set event-log-category configuration admin system

set traffic-log-status enable

set traffic-log-category slb dns llb

next

end