Configuring syslog settings
A remote syslog server is a system provisioned specifically to collect logs for long term storage and analysis with preferred analytic tools.
Before you begin:
- You must have Read-Write permission for Log & Report settings.
To configure syslog settings:
- Go to Log & Report > Log Setting.
- Click the Syslog Server tab.
- If the VDOM is enabled, enable/disable Override to determine which server list to use.
Enable Override to allow the syslog to use the VDOM FortiAnalyzer server list. Otherwise, disable Override to use the Global syslog server list. - Click Create New to display the configuration editor.
- Configure the following settings:
Setting
Description
Status Enable/disable the configuration.
Address Specify the IP address of the syslog server. Port Specify the port that FortiADC uses to communicate with the log server.
This is the listening port number of the syslog server. Usually this is UDP port 514.
Proto
Select the protocol used for log transfer from the following:
UDP
TCP
TCP SSL
TCP Framing
If Proto is TCP or TCP SSL, the TCP Framing options appear.
Select one of the following options:
Traditional
Octet Counted
Log Level
Select the lowest severity to log from the following options:
- Emergency — The system has become unstable.
- Alert — Immediate action is required.
- Critical — Functionality is affected.
- Error — An error condition exists and functionality could be affected.
- Warning — Functionality might be affected.
- Notification — Information about normal events.
- Information — General information about system operations.
- Debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.
The exported logs will include the selected severity level and above. For example, if you select Error, the system sends the syslog server logs with level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with severity level Alert and Emergency.
CSV
Enable to export the logs as a CSV file.
Facility
Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use.
Event
Enable/disable logging for events.
Event Category If Event is enabled, the Event Category options appear.
Select one or more of the following event categories to include in the event logs export:
- Configuration — Configuration changes.
- Admin — Administrator actions.
- System — System operations, warnings, and errors.
- User — Authentication results logs.
- Health Check — Health check results and client certificate validation check results.
- SLB — Notifications, such as connection limit reached.
- LLB — Notifications, such as bandwidth thresholds reached.
- GLB — Notifications, such as the status of associated local SLB and virtual servers.
- Firewall — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.
Traffic
Enable/disable logging for traffic processed by the load-balancing modules.
Traffic Category
If Traffic is enabled, the Traffic Category options appear.
Select one or more of the following traffic categories to include in the traffic logs export:
- SLB — Server Load Balancing traffic logs related to sessions and throughput.
- GLB — Global Load Balancing traffic logs related to DNS requests.
- LLB — Link Load Balancing traffic logs related to session and throughput.
Security
Enable/disable logging for traffic processed by the security modules.
Security Category
If Security is enabled, the Security Category options appear.
Select one or more of the following security categories to include in the security logs export:
- DDoS — DoS protection logs.
- IP Reputation — IP Reputation logs.
- WAF — WAF logs.
- GEO — Geo IP blocking logs.
- AV — AV logs.
- IPS — IPS logs.
- FW — Firewall logs.
- ZTNA — ZTNA logs.
- Click Save.