Fortinet white logo
Fortinet white logo

CLI Reference

config log setting fortianalyzer

config log setting fortianalyzer

Use this command to configure logging to a FortiAnalyzer server using OFTP.

The Optimized Fabric Transfer Protocol (OFTP) is used when information is synchronized between FortiAnalyzer and FortiADC, as well as for other Fortinet products. Remote logging and archiving can be configured on the FortiADC to send logs to a FortiAnalyzer unit.

OFTP listens on port TCP/514.

Note

To configure from global, see config log setting global_faz. Global has preset configurations that users may use for easy configuration, which apply to all VDOMs. However, in config log setting fortianalyzer, the user can customize the configuration for the individual VDOM, overriding the global FortiAnalyzer config.

You can enable override_global_faz here:

FortiADC-VM (root) # config log setting general

FortiADC-VM (general) # show full-configuration

config log setting general

set override_global_faz enable

end

Requirements:
  • Read-write permission for log settings.
  • The FortiAnalyzer service is required to be exposed on External IP.

FortiADC supports integration with FortiAnalyzer versions 7.0.2 or later. As earlier versions of FortiAnalyzer is not optimally compatible with FortiADC, unexpected behavior may occur.

Syntax

config log setting fortianalyzer

edit <name>

set status {enable|disable}

set server <string>

set loglevel {alert|critical|debug|emergency|error|information|notification|warning}

set event-log-status {enable|disable}

set event-log-category {admin|configuration|fw|glb|health-check|llb|slb|system|user}

set traffic-log-status {enable|disable}

set traffic-log-category {slb|dns|llb}

set attack-log-status {enable|disable}

set attack-log-category {av|ddos|geo|ipreputation|ips|waf|fw}

next

end

status

Enable/disable the configuration.

server

Specify the IP address of the FortiAnalyzer Log server.

loglevel

Select the lowest severity to log from the following options:

  • emergency — The system has become unstable.
  • alert — Immediate action is required.
  • critical — Functionality is affected.
  • error — An error condition exists and functionality could be affected.
  • warning — Functionality might be affected.
  • notification — Information about normal events.
  • information — General information about system operations.
  • debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

The exported logs will include the selected severity level and above. For example, if you select error, the system collects logs with severity level error, critical, alert, and emergency. If you select alert, the system collects logs with severity level alert and emergency.

event-log-status

Enable/disable logging for events.

event-log-category

If event-log-status is enabled, the event-log-category becomes configurable.

Select one or more of the following event categories to include in the event logs export:

  • configuration — Configuration changes.
  • admin — Administrator actions.
  • system — System operations, warnings, and errors.
  • user — Authentication results logs.
  • health-check — Health check results and client certificate validation check results.
  • slb — Notifications, such as connection limit reached.
  • llb — Notifications, such as bandwidth thresholds reached.
  • glb — Notifications, such as the status of associated local SLB and virtual servers.
  • fw — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

traffic-log-status

Enable/disable logging for traffic processed by the load-balancing modules.

traffic-log-category

If traffic-log-status is enabled, the traffic-log-category becomes configurable.

Select one or more of the following traffic categories to include in the traffic logs export:

  • slb — Server Load Balancing traffic logs related to sessions and throughput.
  • dns — Global Load Balancing traffic logs related to DNS requests.
  • llb — Link Load Balancing traffic logs related to session and throughput.

attack-log-status

Enable/disable logging for traffic processed by the security modules.

attack-log-category

If attack-log-status is enabled, the attack-log-category becomes configurable.

Select one or more of the following security categories to include in the security logs export:

  • ddos — DoS protection logs.
  • ipreputation — IP Reputation logs.
  • waf — WAF logs.
  • geo — Geo IP blocking logs.
  • av — AV logs.
  • ips — IPS logs.
  • fw — Firewall logs.

Example

config log setting fortianalyzer

edit 1

set status enable

set server 192.8.8.8

set loglevel information

set event-log-status enable

set event-log-category system slb

set traffic-log-status enable

set traffic-log-category slb dns

set attack-log-status enable

set attack-log-category waf av

next

end

config log setting fortianalyzer

config log setting fortianalyzer

Use this command to configure logging to a FortiAnalyzer server using OFTP.

The Optimized Fabric Transfer Protocol (OFTP) is used when information is synchronized between FortiAnalyzer and FortiADC, as well as for other Fortinet products. Remote logging and archiving can be configured on the FortiADC to send logs to a FortiAnalyzer unit.

OFTP listens on port TCP/514.

Note

To configure from global, see config log setting global_faz. Global has preset configurations that users may use for easy configuration, which apply to all VDOMs. However, in config log setting fortianalyzer, the user can customize the configuration for the individual VDOM, overriding the global FortiAnalyzer config.

You can enable override_global_faz here:

FortiADC-VM (root) # config log setting general

FortiADC-VM (general) # show full-configuration

config log setting general

set override_global_faz enable

end

Requirements:
  • Read-write permission for log settings.
  • The FortiAnalyzer service is required to be exposed on External IP.

FortiADC supports integration with FortiAnalyzer versions 7.0.2 or later. As earlier versions of FortiAnalyzer is not optimally compatible with FortiADC, unexpected behavior may occur.

Syntax

config log setting fortianalyzer

edit <name>

set status {enable|disable}

set server <string>

set loglevel {alert|critical|debug|emergency|error|information|notification|warning}

set event-log-status {enable|disable}

set event-log-category {admin|configuration|fw|glb|health-check|llb|slb|system|user}

set traffic-log-status {enable|disable}

set traffic-log-category {slb|dns|llb}

set attack-log-status {enable|disable}

set attack-log-category {av|ddos|geo|ipreputation|ips|waf|fw}

next

end

status

Enable/disable the configuration.

server

Specify the IP address of the FortiAnalyzer Log server.

loglevel

Select the lowest severity to log from the following options:

  • emergency — The system has become unstable.
  • alert — Immediate action is required.
  • critical — Functionality is affected.
  • error — An error condition exists and functionality could be affected.
  • warning — Functionality might be affected.
  • notification — Information about normal events.
  • information — General information about system operations.
  • debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

The exported logs will include the selected severity level and above. For example, if you select error, the system collects logs with severity level error, critical, alert, and emergency. If you select alert, the system collects logs with severity level alert and emergency.

event-log-status

Enable/disable logging for events.

event-log-category

If event-log-status is enabled, the event-log-category becomes configurable.

Select one or more of the following event categories to include in the event logs export:

  • configuration — Configuration changes.
  • admin — Administrator actions.
  • system — System operations, warnings, and errors.
  • user — Authentication results logs.
  • health-check — Health check results and client certificate validation check results.
  • slb — Notifications, such as connection limit reached.
  • llb — Notifications, such as bandwidth thresholds reached.
  • glb — Notifications, such as the status of associated local SLB and virtual servers.
  • fw — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

traffic-log-status

Enable/disable logging for traffic processed by the load-balancing modules.

traffic-log-category

If traffic-log-status is enabled, the traffic-log-category becomes configurable.

Select one or more of the following traffic categories to include in the traffic logs export:

  • slb — Server Load Balancing traffic logs related to sessions and throughput.
  • dns — Global Load Balancing traffic logs related to DNS requests.
  • llb — Link Load Balancing traffic logs related to session and throughput.

attack-log-status

Enable/disable logging for traffic processed by the security modules.

attack-log-category

If attack-log-status is enabled, the attack-log-category becomes configurable.

Select one or more of the following security categories to include in the security logs export:

  • ddos — DoS protection logs.
  • ipreputation — IP Reputation logs.
  • waf — WAF logs.
  • geo — Geo IP blocking logs.
  • av — AV logs.
  • ips — IPS logs.
  • fw — Firewall logs.

Example

config log setting fortianalyzer

edit 1

set status enable

set server 192.8.8.8

set loglevel information

set event-log-status enable

set event-log-category system slb

set traffic-log-status enable

set traffic-log-category slb dns

set attack-log-status enable

set attack-log-category waf av

next

end