log setting remote
Use this command to configure remote log message storage, either on a Syslog server or FortiAnalyzer unit.
Syntax
config log setting remote
set certificate <certificate_name>
set comma-separated-value {enable | disable}
set encryption-log-status {enable | disable}
set event-log-category [{imap pop3 smtp webmail}]
set event-log-status {enable | disable}
set hash-algorithm {sha1 |sha256}
set history-log-status {enable | disable}
set loglevel {alert | critical | debug | emergency | error | information | notification | warning}
set matched-session-status {enable | disable}
set name <log-destination_name>
set port <port_int>
set spam-log-status {enable | disable}
set sysevent-log-category [{admin configuration configuration-user dns ha system update}]
set sysevent-log-status {enable | disable}
set syslog-mode {tcp | tcp-tls | udp}
set virus-log-status {enable | disable}
end
|
Variable |
Description |
Default |
|
Type an index number to identify these remote logging settings. |
|
|
|
Enter the certificate used by TLS to encrypt the Syslog session to the remote Syslog server. This setting is available if |
||
|
Enable if you want to send log messages in comma-separated value (CSV) format. Note: Do not enable this option if the log destination is a FortiAnalyzer unit. FortiAnalyzer units do not support logs in CSV format. |
disable |
|
|
Enter a descriptive comment. |
|
|
|
Enable or disable IBE event logging to a remote Syslog server or FortiAnalyzer unit. See also system encryption ibe. |
disable |
|
|
Type all of the mail daemon log types and subtypes that you want to record to this storage location. Separate each type with a space.
|
|
|
|
Enable or disable event logging to a remote Syslog server or FortiAnalyzer unit. |
disable |
|
|
facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kern | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news | ntp} |
Type the facility identifier that the FortiMail unit will use to identify itself when sending log messages to the Syslog server. To easily identify log messages from the FortiMail unit when they are stored on the Syslog server, enter a unique facility identifier, and verify that no other network devices use the same facility identifier. |
kern |
|
Select the hash algorithm to use in OFTPS encryption. This setting is available if |
sha1 |
|
|
Enable to log both successful and unsuccessful attempts by the built-in MTA or SMTP proxy to deliver email. See also event-log-category [{imap pop3 smtp webmail}]. |
disable |
|
|
loglevel {alert | critical | debug | emergency | error | information | notification | warning} |
Type one of the following severity levels:
This log destination will receive log messages greater than or equal to this severity level. For details, see the FortiMail Administration Guide. |
information |
|
Enable to send only matching session logs to the remote server. Otherwise, FortiMail will send all logs. This option appears if you enabled advanced MTA control. |
disable |
|
|
Enter a unique name for this configuration. |
|
|
|
If the remote host is a FortiAnalyzer unit, type |
514 |
|
|
Enter the protocol used to communicate with the remote log server.
|
syslog |
|
|
Type the IPv4, IPv6, or domain name (FQDN) address of the Syslog server or FortiAnalyzer unit. |
|
|
|
disable |
||
|
Enable to send log messages to a remote Syslog server or FortiAnalyzer unit. |
disable |
|
|
sysevent-log-category [{admin configuration configuration-user dns ha system update}] |
Type all of the system event log types and subtypes that you want to record to this storage location. Separate each type with a space.
|
|
|
Enable to log system events. |
disable |
|
|
Enter the transport-layer protocol used for delivering the log to the remote Syslog server:
|
udp |
|
|
disable |