Overview

Collection

Fortigate appliances can send log data to third party syslog servers. Configuration on a per-device basis is available via the command-line interface. In particular, the "config log syslog setting" command provides the following options:

config log syslogd setting
  set csv {disable | enable}
  set facility <facility_name>
  set port <port_integer>
  set reliable {disable | enable}
  set server <ip_address>
  set status {disable | enable}
end

For delivery to a Snare Central server, it is recommended that the following settings be used:

• CSV: enable

• Facility: local0

• Port: 514

• Reliable: disable

  • Note that 'reliable delivery' as defined by Fortigate, means that the content will be sent encrypted, using RFC3195 (https://tools.ietf.org/html/rfc3195) compatible protocols to port 601. The Snare Central server supports encrypted syslog content, but not via RFC3195.

• Server: The IP address of the Snare Central server

• Status: enable

Syslog criticality levels are dynamically determined by the source event priority.

Log priority levels

The Debug priority level, not shown above, is rarely used. It is the lowest log priority level and usually contains some firmware status information that is useful when the FortiGate unit is not functioning properly.

Fields

Notes

This log collection module is currently under construction, and final fields may vary from those shown above.