Syslog - Fortinet FortiGate v5.4/v5.6

Device Details

Vendor	Fortinet
Device Type	Firewall
Supported Model Name/Number	FortiGate Firewall
Supported Software Version(s)	FortiOS 5.4, FortiOS 5.6
Collection Method	Syslog
Configurable Log Output?	Yes
Log Source Type	Syslog - Fortinet FortiGate v5.4/v5.6
Log Processing Policy	LogRhythm Default
Exceptions	N/A
Additional Information	Logging output is configurable to “default,” “CEF,” or “CSV.” The “default” configuration is the format accepted by this policy. This format is space-delimited and double-quote encapsulated. https://www.fortinet.com/products.html https://docs.fortinet.com/product/fortigate/5.4 https://docs.fortinet.com/product/fortigate/5.6 https://docs.fortinet.com/document/fortigate/5.6.13/fortios-log-message-reference

Prerequisites

Fortinet FortiGate appliance update to FortiOS version 5.4 or 5.6 required.

Device Configuration Checklist

FortiOS logging output must be set to default. Your FortiGate device should already be set to this mode, but if the logging output contains commas (,) or pipe (|) characters, then you are running in either CSV or CEF mode and need to perform the following configuration:

1. Enter CLI mode.
2. Set logging output to default with the following commands:

   • config log syslogd setting

     

     In this example, “syslogd” is the first log output of the FortiGate device. 

   • set format default
   • end

Supported Log Messages

(List of LR Tags used to parse the log information for each message type)

Revision History