FortiGate Administration Guide - FirewallShop.com

High Availability cluster logging
Log&Report
High Availability cluster logging
When configuring logging with a High Availability (HA) cluster, configure the
primary unit to send logs to a FortiAnalyzer unit or a Syslog server. The settings
will apply to the subordinate units. The subordinate units send the log messages
to the primary unit, and the primary unit sends all logs to the FortiAnalyzer unit or
Syslog server.
If you configured a secure connection via an IPSec VPN tunnel between a
FortiAnalyzer unit and a HA cluster, the connection is between the FortiAnalyzer
unit and the HA cluster primary unit.
See the FortiGate High Availability User Guide for more information.
Storing Logs
The type and frequency of log messages you intend to save dictates the type of
log storage to use. For example, if you want to log traffic and content logs, you
need to configure the FortiGate unit to log to a FortiAnalyzer unit or Syslog server.
The FortiGate system memory is unable to log traffic and content logs because of
their frequency and large file size.
Storing log messages to one or more locations, such as a FortiAnalyzer unit or
Syslog server, may be a better solution for your logging requirements than the
FortiGate system memory. Configuring your FortiGate unit to log to a FortiGuard
Analysis server may also be a better log storage solution if you have a
FortiGate-100A unit or lower. Logging to a FortiGuard Analysis server will be
available for all FortiGate units in future releases. See “Logging to a FortiGuard
Analysis server” on page 479 for more information.
If your FortiGate unit has a hard disk, you can also enable logging to the hard disk
from the CLI. See the FortiGate CLI Reference for more information before
enabling logging to the hard disk.
If you require logging to multiple FortiAnalyzer units or Syslog servers, see the
FortiGate CLI Reference for more information.
Note: Daylight Saving Time (DST) is now extended by four weeks in accordance to the
U.S. Energy Policy Act of 2005 and only affects North America. It is recommended to check
if you location observes this change, since it affects the accuracy and schedule of logs. See
the Fortinet Knowledge Center article, New Daily Saving Time support, for more
information.
Logging to a FortiAnalyzer unit
FortiAnalyzer units are network appliances that provide integrated log collection,
analysis tools and data storage. Detailed log reports provide historical as well as
current analysis of network and email activity to help identify security issues and
reduce network misuse and abuse.
FortiGate Version 3.0 MR5 Administration Guide
472 01-30005-0203-20070830