config log setting fortianalyzer
Use this command to configure logging to a FortiAnalyzer server using OFTP.
The Optimized Fabric Transfer Protocol (OFTP) is used when information is synchronized between FortiAnalyzer and FortiADC, as well as for other Fortinet products. Remote logging and archiving can be configured on the FortiADC to send logs to a FortiAnalyzer unit.
OFTP listens on port TCP/514.
To configure from global, see config log setting global_faz. Global has preset configurations that users may use for easy configuration, which apply to all VDOMs. However, in config log setting fortianalyzer, the user can customize the configuration for the individual VDOM, overriding the global FortiAnalyzer config. You can enable override_global_faz here: FortiADC-VM (root) # config log setting general FortiADC-VM (general) # show full-configuration config log setting general set override_global_faz enable end |
Requirements:
- Read-write permission for log settings.
- The FortiAnalyzer service is required to be exposed on External IP.
FortiADC supports integration with FortiAnalyzer versions 7.0.2 or later. As earlier versions of FortiAnalyzer is not optimally compatible with FortiADC, unexpected behavior may occur. |
Syntax
config log setting fortianalyzer
edit <name>
set status {enable|disable}
set server <string>
set loglevel {alert|critical|debug|emergency|error|information|notification|warning}
set event-log-status {enable|disable}
set event-log-category {admin|configuration|fw|glb|health-check|llb|slb|system|user}
set traffic-log-status {enable|disable}
set traffic-log-category {slb|dns|llb}
set attack-log-status {enable|disable}
set attack-log-category {av|ddos|geo|ipreputation|ips|waf|fw}
next
end
status |
Enable/disable the configuration. |
server |
Specify the IP address of the FortiAnalyzer Log server. |
loglevel |
Select the lowest severity to log from the following options:
The exported logs will include the selected severity level and above. For example, if you select error, the system collects logs with severity level error, critical, alert, and emergency. If you select alert, the system collects logs with severity level alert and emergency. |
event-log-status |
Enable/disable logging for events. |
event-log-category |
If event-log-status is enabled, the event-log-category becomes configurable. Select one or more of the following event categories to include in the event logs export:
|
traffic-log-status |
Enable/disable logging for traffic processed by the load-balancing modules. |
traffic-log-category |
If traffic-log-status is enabled, the traffic-log-category becomes configurable. Select one or more of the following traffic categories to include in the traffic logs export:
|
attack-log-status |
Enable/disable logging for traffic processed by the security modules. |
attack-log-category |
If attack-log-status is enabled, the attack-log-category becomes configurable. Select one or more of the following security categories to include in the security logs export:
|
Example
config log setting fortianalyzer
edit 1
set status enable
set server 192.8.8.8
set loglevel information
set event-log-status enable
set event-log-category system slb
set traffic-log-status enable
set traffic-log-category slb dns
set attack-log-status enable
set attack-log-category waf av
next
end