Fortinet black logo

CLI Reference

log syslog-policy

log syslog-policy

Use this command to configure a connection to one or more Syslog servers. Each policy can specify connections for up to three Syslog servers. The log syslogd configuration uses the policy to define the specific Syslog server or servers on which log messages are stored. For details, see log syslogd.

To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For details, see Permissions.

Syntax

config log syslog-policy

edit "<policy_name>"

config syslog-server-list

edit <entry_index>

set port <port_int>

set proto {tcp | tls | udp}

set packet {enable | disable}

set format {cef | csv | default | json}

set server "<syslog_ipv4>"

set cus-fields <cus-fields_name>

end

next

end

Variable Description Default

"<policy_name>"

Enter the name of a new or existing Syslog policy. The maximum length is 63 characters.

The name of the report profile will be included in the report header.

To display the list of existing policies, enter:

edit ?

No default.

<entry_index>

Enter the index number of the individual entry in the table.

You can create up to 3 connections.
No default.

port <port_int>

Enter the port number on which the Syslog server listens.

The valid range is 1–65,535.

514

proto {tcp | tls | udp}

Select the protocol to transfer the logs between FortiWeb and the syslog server.

udp

format {cef | csv | default | json}

Select the format of the system log. Note that CEF is for Syslog server, not for SIEM. If your receiver is a SIEM server such as Azure Sentinel, please refer to Configuring SIEM policies in FortiWeb Administration Guide.

default

server "<syslog_ipv4>"

Enter the IP address of the Syslog server. No default.

packet {enable | disable}

Enable packet to include packet payloads in the JSON format logs. Packet payloads supplement the log message by providing the actual request headers and body. This option is available only when the Format is JSON and the Protocol is TCP or TLS.

  • Please note that using JSON format or enabling packet payloads may have negative impact on system performance.
  • disable

    cus-fields <cus-fields_name>

    Select one of the identifiers you have defined in config log syslogd under config custom-field. It will be attached to the syslog records.

    No default.

    Example

    This example creates Syslog_Policy1. The Syslog server is contacted by its IP address, 192.168.1.10. Communications occur over the standard port number for Syslog, UDP port 514. The FortiWeb appliance sends log messages to the Syslog server in CSV format.

    config log syslog-policy

    edit "Syslog_Policy1"

    config log-server-list

    edit 1

    set server "192.168.1.10"

    set port 514

    set csv enable

    end

    next

    end

    Related topics

    log syslog-policy

    Use this command to configure a connection to one or more Syslog servers. Each policy can specify connections for up to three Syslog servers. The log syslogd configuration uses the policy to define the specific Syslog server or servers on which log messages are stored. For details, see log syslogd.

    To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For details, see Permissions.

    Syntax

    config log syslog-policy

    edit "<policy_name>"

    config syslog-server-list

    edit <entry_index>

    set port <port_int>

    set proto {tcp | tls | udp}

    set packet {enable | disable}

    set format {cef | csv | default | json}

    set server "<syslog_ipv4>"

    set cus-fields <cus-fields_name>

    end

    next

    end

    Variable Description Default

    "<policy_name>"

    Enter the name of a new or existing Syslog policy. The maximum length is 63 characters.

    The name of the report profile will be included in the report header.

    To display the list of existing policies, enter:

    edit ?

    No default.

    <entry_index>

    Enter the index number of the individual entry in the table.

    You can create up to 3 connections.
    No default.

    port <port_int>

    Enter the port number on which the Syslog server listens.

    The valid range is 1–65,535.

    514

    proto {tcp | tls | udp}

    Select the protocol to transfer the logs between FortiWeb and the syslog server.

    udp

    format {cef | csv | default | json}

    Select the format of the system log. Note that CEF is for Syslog server, not for SIEM. If your receiver is a SIEM server such as Azure Sentinel, please refer to Configuring SIEM policies in FortiWeb Administration Guide.

    default

    server "<syslog_ipv4>"

    Enter the IP address of the Syslog server. No default.

    packet {enable | disable}

    Enable packet to include packet payloads in the JSON format logs. Packet payloads supplement the log message by providing the actual request headers and body. This option is available only when the Format is JSON and the Protocol is TCP or TLS.

  • Please note that using JSON format or enabling packet payloads may have negative impact on system performance.
  • disable

    cus-fields <cus-fields_name>

    Select one of the identifiers you have defined in config log syslogd under config custom-field. It will be attached to the syslog records.

    No default.

    Example

    This example creates Syslog_Policy1. The Syslog server is contacted by its IP address, 192.168.1.10. Communications occur over the standard port number for Syslog, UDP port 514. The FortiWeb appliance sends log messages to the Syslog server in CSV format.

    config log syslog-policy

    edit "Syslog_Policy1"

    config log-server-list

    edit 1

    set server "192.168.1.10"

    set port 514

    set csv enable

    end

    next

    end

    Related topics