FortiGate Administration Guide - FirewallShop.com

Storing Logs
Log&Report
Logging to a Syslog server
A Syslog server is a remote computer running Syslog software and is an industry
standard for logging. Syslog is used to capture log information provided by
network devices. The Syslog server is both a convenient and flexible logging
device, since any computer can run syslog software, such as Linux, Unix, and
intel-based Windows systems.
When configuring logging to a Syslog server, you need to configure the facility and
log file format, normal or Comma Separated Values (CSV). The CSV format
contains commas whereas the normal format contains spaces. Configuring a
facility easily identifies the device that recorded the log file.
Figure 328:Logging to a Syslog server
To configure the FortiGate unit to send logs to a syslog server
1 Go to Log&Report > Log Config > Log Setting.
2 Select Syslog.
3 Select the blue arrow to expand the Syslog options.
4 Set the following syslog options and select Apply:
Name/IP
Port
Level
Facility
Enable CSV
Format
The domain name or IP address of the syslog server.
The port number for communication with the syslog server, typically
port 514.
The FortiGate unit logs all messages at and above the logging
severity level you select. For details on the logging levels, see
Table 44, “Log severity levels,” on page 471.
Facility indicates to the syslog server the source of a log message.
By default, FortiGate reports Facility as local7. You may want to
change Facility to distinguish log messages from different FortiGate
units.
If you enable CSV format, the FortiGate unit produces the log in
Comma Separated Value (CSV) format. If you do not enable CSV
format the FortiGate unit produces plain text files.
Note: If more than one Syslog server is configured, the Syslog servers and their settings
display on the Log Settings page. Configuring multiple Syslog servers is done in the CLI.
See the FortiGate CLI Reference for more information.
FortiGate Version 3.0 MR5 Administration Guide
476 01-30005-0203-20070830