Sending EMS system log messages to FortiAnalyzer

EMS can send server logs to FortiAnalyzer for reporting and investigation. For audit purposes, you should log all admin activity.

To configure sending EMS system log messages to FortiAnalyzer:

1. Authorize the EMS in FortiAnalyzer to allow FortiAnalyzer to receive logs from the EMS instance:
   1. In FortiAnalyzer, go to Device Manager.
   2. Click Add Device.
   3. In the Add Device dialog, in the Serial Number field, enter the EMS serial number. FortiAnalyzer automatically recognizes that the device is an EMS instance from the serial number.
   4. Configure other fields as desired, then click Next.

      

      EMS is added as an authorized device and FortiAnalyzer is ready to receive its logs.

      

2. In EMS, go to System Settings > Log Settings.
3. For Send system logs externally, select FortiAnalyzer.
4. In the FortiAnalyzer server address field, enter the FortiAnalyzer server IP address.
5. In the FortiAnalyzer server port field, configure the desired port. This example keeps the default value, 514.
6. From the Data protocol dropdown list, select the desired data protocol. This example selects UDP.
7. Click Save.

   

8. In FortiAnalyzer, go to Log View > FortiClient to view EMS logs.