Enable/disable logging for security events.

If attack-log-status is enabled, the attack-log-category becomes configurable.

Select one or more of the following security categories to include in the security logs export:

• ddos — DoS protection logs.
• ipreputation — IP Reputation logs.
• waf — WAF logs.
• geo — Geo IP blocking logs.
• av — AV logs.
• ips — IPS logs.
• fw — Firewall logs.
• ztna — ZTNA logs.

Send logs in CSV format. Do not use with FortiAnalyzer.

Enable/disable logging for system events.

If event-log-status is enabled, the event-log-category becomes configurable.

Select one or more of the following event categories to include in the event logs export:

• configuration — Configuration changes.
• admin — Administrator actions.
• system — System operations, warnings, and errors.
• user — Authentication results logs.
• health-check — Health check results and client certificate validation check results.
• slb — Notifications, such as connection limit reached.
• llb — Notifications, such as bandwidth thresholds reached.
• glb — Notifications, such as the status of associated local SLB and virtual servers.
• fw — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

Identifier that is not used by any other device on your network when sending logs to FortiAnalyzer/syslog.

Select the lowest severity to log from the following options:

• emergency — The system has become unstable.
• alert — Immediate action is required.
• critical — Functionality is affected.
• error — An error condition exists and functionality could be affected.
• warning — Functionality might be affected.
• notification — Information about normal events.
• information — General information about system operations.
• debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

The exported logs will include the selected severity level and above. For example, if you select error, the system collects logs with severity level error, critical, alert, and emergency. If you select alert, the system collects logs with severity level alert and emergency.

Listening port number of the syslog server. Usually this is UDP/TCP/TCPSSL port 514.

IP address of the syslog server.

Enable/disable the configuration.

Use protocol to transfer log messages.

The frame in which the log message is stored in tcp/tcpssl packets.

Enable/disable logging for traffic processed by the load balancing modules.