log syslog-policy

Use this command to configure a connection to one or more Syslog servers. Each policy can specify connections for up to three Syslog servers. The log syslogd configuration uses the policy to define the specific Syslog server or servers on which log messages are stored. For details, see log syslogd.

To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For details, see Permissions.

Syntax

config log syslog-policy

edit "<policy_name>"

config syslog-server-list

edit <entry_index>

set port <port_int>

set proto {tcp | tls | udp}

set packet {enable | disable}

set format {cef | csv | default | json}

set server "<syslog_ipv4>"

set cus-fields <cus-fields_name>

end

next

end

Variable	Description	Default
"<policy_name>"	Enter the name of a new or existing Syslog policy. The maximum length is 63 characters. The name of the report profile will be included in the report header. To display the list of existing policies, enter: edit ?	No default.
<entry_index>	Enter the index number of the individual entry in the table. You can create up to 3 connections.	No default.
port <port_int>	Enter the port number on which the Syslog server listens. The valid range is 1–65,535.	514
proto {tcp | tls | udp}	Select the protocol to transfer the logs between FortiWeb and the syslog server.	udp
format {cef | csv | default | json}	Select the format of the system log. Note that CEF is for Syslog server, not for SIEM. If your receiver is a SIEM server such as Azure Sentinel, please refer to Configuring SIEM policies in FortiWeb Administration Guide.	default
server "<syslog_ipv4>"	Enter the IP address of the Syslog server.	No default.
packet {enable | disable}	Enable packet to include packet payloads in the JSON format logs. Packet payloads supplement the log message by providing the actual request headers and body. This option is available only when the Format is JSON and the Protocol is TCP or TLS. Please note that using JSON format or enabling packet payloads may have negative impact on system performance.	disable
cus-fields <cus-fields_name>	Select one of the identifiers you have defined in config log syslogd under config custom-field. It will be attached to the syslog records.	No default.

Example

This example creates Syslog_Policy1. The Syslog server is contacted by its IP address, 192.168.1.10. Communications occur over the standard port number for Syslog, UDP port 514. The FortiWeb appliance sends log messages to the Syslog server in CSV format.

config log syslog-policy

edit "Syslog_Policy1"

config log-server-list

edit 1

set server "192.168.1.10"

set port 514

set csv enable

end

next

end

Related topics

• log syslogd
• system dns
• router static