How to choose a log device for your network topology
When planning the log requirements, you must also consider your network’s topology and whether archiving is required, such as if there is a legal requirement to keep a historical record of network activity. The following explains what steps to take when choosing a log device for your specific network topology.
1. What is the scope of your network topology?
If it is a SOHO/SMB network, then logging to the FortiGate unit’s local hard disk or the default FortiCloud service would be efficient. If the network topology is a large enterprise, you will need FortiAnalyzer units, a FortiCloud contract, Syslog servers, or any combination.
2. Is archiving required?
If the network activity that is being logged needs to be archived, then, depending on your network topology, you would choose a FortiAnalyzer unit. FortiAnalyzer units store archives in the same way that FortiGate units do, but are able to store large amounts of logs and archives.
3. When troubleshooting issues, you may want to log features such as traffic, that would not be logged otherwise; how much storage space will you need?
Logs can be configured to roll, which is similar to zipping a file; this will lower the space requirements needed to contain them. You can also download logs from the FortiGate unit and save them on a server or on a computer to view and access later, to prevent them from piling up and being overwritten. If you’re only temporarily logging a larger amount of traffic, you could upload the logs to an FTP server or cloud service to ensure that these logs are not lost even after you are finished correcting the issue.
4. Should I invest in a log device that can grow as my network grows?
All networks grow, so investing in a device that can grow with your network and that can be expanded is a good investment. For example, if you currently have a SOHO/SMB topology, but see growth already starting, a FortiAnalyzer unit would be best. A FortiAnalyzer unit provides ample storage space, as well as you can add two more FortiAnalyzer units to access additional storage and create a redundancy log backup solution.