Syslog - Fortinet FortiGate v4.0+

FortiGate supports CSV and non-CSV log output formats. LogRhythm requires FortiGate logs to be in non-CSV format, and this is the default FortiGate setting.

To verify the output format, do the following:

1. Log in to the FortiGate Admin Utility.

2. Connect to the Command Line Interface Console and type show log <syslogd> setting.

   1. If set csv enable is not listed, logs will be generated in the correct space-delimited format, and no further configuration is required.

   2. If set set csv enable is listed, you must change the output format.

   3. To disable CSV, type set csv disable.

3. To verify the change, type show log <syslogd> setting again and verify that set csv enable is not listed.

Configure LogRhythm for FortiGate

No additional changes are necessary to configure LogRhythm to work with a Fortinet FortiGate v4.0+ device.