Using Logs and Reports : Configuring remote log server settings for event logs
 
Configuring remote log server settings for event logs
A remote log server is a system provisioned specifically to collect logs for long term storage and analysis with preferred analytic tools. We recommend FortiAnalyzer.
The system has two configurations to support sending logs to remote log servers: remote log server settings for system event logs, and remote log server settings for DDoS logs.
The system event log configuration applies to system-wide data, such as system health indicators and system administrator activities. The DDoS log configuration applies to security data.
Before you begin:
• You must have Read-Write permission for Log & Report settings.
See also: “Configuring remote log server settings for the DDoS attack log”.
To configure remote event log settings:
1. Go to Log & Report > Log Configuration > Log Remote.
2. Complete the configuration as described in Table 54.
3. Save the configuration.
Figure 89: Remote logging configuration page
 
Table 54: Remote log configuration guidelines
Settings
Guidelines
Enable
Select to display settings to manage the disk used for logging.
Address
IP address of the FortiAnalyzer or syslog server.
Port
Listening port number of the FortiAnalyzer/syslog server. Usually this is UDP port 514.
CSV Format
Send logs in CSV format. Do not use with FortiAnalyzer.
Minimum Log Level
Select the lowest severity to log from the following choices:
• Emergency—The system has become unstable.
• Alert—Immediate action is required.
• Critical—Functionality is affected.
• Error—An error condition exists and functionality could be affected.
• Warning—Functionality might be affected.
• Notification—Information about normal events.
• Information—General information about system operations.
• Debug—Detailed information about the system that can be used to troubleshoot unexpected behavior.
For example, if you select Error, the system sends the syslog server logs with level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with level Alert and Emergency.
Facility
Identifier that is not used by any other device on your network when sending logs to FortiAnalyzer/syslog.
Event Logging
Select to enable event logging and then select the types of events that you want included in the event log.
The following is an example of an event syslog message:
device_id=SYSLOG-AC1E997F type=generic pri=information itime=1431633173 msg="date=2015-05-13,time=13:25:13,tz=PDT,devid=FI800B3913000032,log_id=0000002168,type=event,subtype=config,level=information,msg_id=426204,user=admin,ui=ssh(172.30.153.9),action=none,status=none,reason=none,msg='changed settings for 'ddos spp setting' on domain 'SPP-1''"
Table 55 identifies the fields in the event syslog message.
Table 55: Event syslog fields
Field
Example
Syslog device ID
device_id=SYSLOG-AC1E997F
Syslog type
type=generic
Syslog log level
pri=information
Syslog time
itime=1431633173
Log datestamp
date=2015-05-13
Log timestamp
13:25:13
Log time zone
tz=PDT
Device ID
devid=FI800B3913000032
Log ID
log_id=0000002168
Log type
type=event
Log subtype
subtype=config
Log level
level=information
Message ID
msg_id=426204
Admin user
user=admin
Admin UI
ui=ssh(172.30.153.9)
Action
action=none
Status
status=none
Reason string
reason=none
Log message
msg='changed settings for 'ddos spp setting' on domain 'SPP-1''"