Configuring multiple FortiAnalyzers (or syslog servers) per VDOM

In a VDOM, multiple FortiAnalyzer and syslog servers can be configured as follows:

  • Up to three override FortiAnalyzer servers
  • Up to four override syslog servers

If the VDOM faz-override and/or syslog-override setting is enabled or disabled (default) before upgrading, the setting remains the same after upgrading.

If the override setting is disabled, the GUI displays the global FortiAnalyzer1 or syslog1 setting. If the override setting is enabled, the GUI displays the VDOM override FortiAnalyzer1 or syslog1 setting.

You can only use CLI to enable the override to support multiple log servers.

To enable FortiAnalyzer and syslog server override under VDOM:
config log setting
    set faz-override enable
    set syslog-override enable

When faz-override and/or syslog-override is enabled, the following CLI commands are available for configuring VDOM override:

To configure VDOM override for FortiAnalyzer:
  1. Configure the FortiAnalyzer override