Log

FortiSwitchOS provides a robust logging environment that enables you to monitor, store, and report traffic information and FortiSwitch events, including attempted log ins and hardware status. Depending on your requirements, you can log to a number of different hosts.

To configure event logging using the GUI:

1. Go to Log > Config.
   
   
   
2. Under Event Type, select Enable.
3. Under Event Type, select the categories of events that you want logged.
4. Select Apply.

To configure event logging using the CLI:

config log eventfilter

set event {enable | disable}

set link {enable | disable}

set poe {enable | disable}

set router {enable | disable}

set spanning_tree {enable | disable}

set switch {enable | disable}

set switch_controller {enable | disable}

set system {enable | disable}

set user {enable | disable}

end

To view the event logs in the GUI:

1. Go to Log > Entries.
2. From the Subtype dropdown list, select the type of log entries to view.
3. From the Level dropdown list, select the severity of events to view.
4. From the User dropdown list, select which user or process generated the log entry.
5. From the User Interface dropdown list, select the IP network service that applies to the log entry.
6. From the Action dropdown list, select the event to view.
7. From the Status dropdown list, select the event result to view.

The MAC event log does not report any MAC changes on the port when 802.1X authentication is enabled.

To view the event logs in the CLI:

show log eventfilter

Syslog server

Sysog is an industry standard for collecting log messages for off-site storage. You can send logs to a single syslog server. The syslog server can be configured in the GUI or CLI. Reliable syslog (RFC 6587) can be configured only in the CLI.

To configure a syslog server in the GUI:

1. Go to Log > Config.
   
   
   
2. Under Syslog, select Enable.
3. Select the severity of events to log.
4. Enter the IP address or fully qualified domain name in the Server field.
5. Enter the port number that the syslog server will use. By default, port 514 is used.
6. Select Apply.

To configure a syslog server in the CLI:

config log syslogd setting

set status enable

set server <IP address or FQDN of the syslog server>

set port <port number that the syslog server will use for logging traffic>

set facility <facility used for remote syslog>

set source-ip <source IP address of the syslog server>

end

For example, to set the source IP address of a syslog server to have an IP address of 192.168.4.5:

config log syslogd setting

set status enable

set source-ip 192.168.4.5

end

To configure a reliable syslog server in the CLI:

config log syslogd setting

set status enable

set server <IP address or FQDN of the syslog server>

set mode reliable

set port <port number that the syslog server will use for logging traffic>

set enc-algorithm {high | high-medium | low}

set certificate <certificate_used_to_communicate_with_syslog_server>

end

For example:

config log syslogd setting

set status enable

set source-ip 192.168.4.5

set mode reliable

set port 6514 // This is the default port used for reliable syslog.

set enc-algorithm high-medium

set certificate "155-sub-client"

end