How to configure syslog on FortiGate
Below are the steps that can be followed to configure the syslog server:
From the GUI:
- Log into the FortiGate.
- Select Log & Report to expand the menu.
- Select Log Settings.
- Toggle Send Logs to Syslog to Enabled.
- Enter the Syslog Collector IP address.
- Select Apply.
If it is necessary to customize the port or protocol or set the Syslog from the CLI below are the commands:
config log syslogd setting
set status enable
set server "192.168.1.19"
set mode udp
set port 514
end
To establish the connection to the Syslog Server using a specific Source IP Address, use the below CLI configuration:
config log syslogd setting
set status enable
set server "192.168.1.19"
set source-ip "192.168.1.1"
set mode udp
set port 514
end
The source ‘192.168.1.1’ can be any IP address of the FortiGate’s interface that can reach the syslog server IP of ‘192.168.1.19’ in the above example.
The ping and ping-options command from the CLI can be used to check basic connectivity to the Syslog server from a specific source IP.
exec ping-options source 192.168.1.1
exec ping 192.168.1.19
PING 192.168.1.19 (192.168.1.19): 56 data bytes
64 bytes from 192.168.1.19: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 192.168.1.19: icmp_seq=1 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=2 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=3 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=4 ttl=255 time=0.1 ms
--- 192.168.1.19 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.2 ms