Configuring logging to multiple Syslog servers
When configuring multiple Syslog servers (or one Syslog server), you can configure reliable delivery of log messages from the Syslog server. Configuring of reliable delivery is available only in the CLI.
If VDOMs are enabled, you can configure multiple FortiAnalyzer units or Syslog servers for each VDOM.
To enable logging to multiple Syslog servers
1. Log in to the CLI.
Enter the following commands:
config log syslogd setting
set csv {disable | enable}
set facility <facility_name>
set port <port_integer>
set reliable {disable | enable}
set server <ip_address>
set status {disable | enable}
end
2. Enter the following commands to configure the second Syslog server:
config log syslogd2 setting
set csv {disable | enable}
set facility <facility_name>
set port <port_integer>
set reliable {disable | enable}
set server <ip_address>
set status {disable | enable}
end
3. Enter the following commands to configure the third Syslog server:
config log syslogd3 setting
set csv {disable | enable}
set facility <facility_name>
set port <port_integer>
set reliable {disable | enable}
set server <ip_address>
set status {disable | enable}
end
Most FortiGate features are, by default, enabled for logging. You can disable individual FortiGate features you do not want the Syslog server to record, as in this example:
config log syslogd filter
set traffic {enable | disable}
set web {enable | disable}
set url-filter {enable | disable}
end