FortiGate Administration Guide - FirewallShop.com

FortiGuard Analysis Service
Log&Report
You can customize the level that the FortiGate unit logs these events at as well as
where the FortiGate unit stores the logs. The level these events are logged at, or
the severity level, is defined when configuring the logging location. There are six
severity levels to choose from. See “Log severity levels” on page 471 for more
information.
For better log storage and retrieval, the FortiGate unit can send log messages to a
FortiAnalyzer unit. FortiAnalyzer units are network appliances that provide
integrated log collection, analysis tools and data storage. Detailed log reports
provide historical as well as current analysis of network and email activity. Detailed
log reports also help identify security issues, reducing network misuse and abuse.
The FortiGate unit can send all log message types, as well as quarantine files, to
a FortiAnalyzer unit for storage. The FortiAnalyzer unit can upload log files to an
FTP server for archival purposes. See “Logging to a FortiAnalyzer unit” on
page 472 for details on configuring the FortiGate unit to send log messages to a
FortiAnalyzer unit.
The FortiGate unit can send log messages to either a Syslog server or
WebTrends server for storage and archival purposes. You can also configure the
FortiGate unit to send log messages to its hard disk, if available. Configuring the
FortiGate unit to send log messages to the hard disk is only available in the CLI.
See the FortiGate CLI Reference for configuring logging to the hard disk.
The FortiGate unit enables you to view log messages available in memory, on a
FortiAnalyzer unit running firmware version 3.0 or higher, including the hard disk if
available. Customizable filters enable you to easily locate specific information
within the log files.
See the FortiGate Log Message Reference for details and descriptions of log
messages and formats.
FortiGuard Analysis Service
FortiGuard Analysis Service is a subscription-based service that provides logging
and reporting solutions for FortiGate-100A units and lower. The FortiGuard
Analysis Service is available on FortiGate-100A units and lower running FortiOS
3.0MR4 and higher.
The FortiGuard Analysis network is made up of two types of servers, the primary
analysis server and the secondary analysis server. The primary analysis server
stores logs generated from the FortiGate unit. The secondary analysis server
provides redundancy, ensuring log data is available at all times. There are several
secondary analysis servers available for redundancy for each FortiGate unit. The
network also includes the main analysis server, which is responsible for
monitoring and maintaining the primary and secondary analysis servers.
When the FortiGate unit connects for the first time to the FortiGuard Analysis
network, the FortiGate unit retrieves its assigned primary analysis server, contract
term, and storage space quota from the main analysis server. The main analysis
server contains this information so it can maintain and monitor the status of each
of the servers.
After configuring logging to the assigned primary analysis server, the FortiGate
unit begins logging to that primary analysis server. The FortiGate unit sends
encrypted logs to the primary analysis server using TCP port 514. The connection
to the main analysis server is secured by SSL using port 443.
FortiGate Version 3.0 MR5 Administration Guide
470 01-30005-0203-20070830