Forward log events to syslog through Fortianalyzer

Question

I'm trying to send my logs from fortianalyzer to graylog, i've set up logforwarding to syslog and i can see some logs that look like this on graylog

<190>logver=702071577 timestamp=1714736929 devname="FGT_Site" devid="someid" vd="root" date=2024-05-03 time=04:48:49 eventtime=1714736929313426129 tz="-0700" logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" appid=41469 srcip=someip srccountry="Reserved" dstip=someip dstcountry="United States" srcport=someport dstport=someport srcintf="lan" srcintfrole="lan" dstintf="lan2" dstintfrole="undefined" proto=6 service="SSL" direction="outgoing" policyid=24 poluuid="someid" policytype="policy" sessionid=somesessionid applist="APP_profile" action="pass" appcat="Collaboration" app="Microsoft.Portal" hostname="name" incidentserialno=41924636 url="/" msg="Collaboration: Microsoft.Portal" apprisk="elevated" scertcname="*.events.data.microsoft.com" scertissuer="Microsoft Secure Server CA 2011""

But I think those are just some of the logs because on fortianalyzer i see this list

there are different types of logs and for example the logs in "fortianlayzer" called event logs that show login attempts, logged in user etc aren't available on graylog, I wasn't able to spot a single one, I'm assuming the fortigates themsleves will have similar event logs and I can't see those either, is there a solution? Been stuck for hours

Answer 1

Well I've done the following: went to fortianalyzer system > advanced settings >syslogserver and created a server and assigned a certain name to it, then on the fortianalyzer's cli, I typed the commands:

config system locallog syslogd setting

set severity information

set status enable

set syslog-name <syslog server name>

end

then back on graylog I created an input to listen on the port I assigned and just like that I'm seeing the local traffic of fortianalyzer. However I'm not sure yet about the local traffic of the fortigates themsleves, as well as forward traffic, I'll look into it.

Answer 2

Fortigate has good documentation on how to do this:

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/250999/log-settings-and-targets

Basically you want to log forward traffic from the firewall itself to the syslog server. Fortianalyzer already analyzes the summarized traffic so logs from it will be just filtered and minimal information. For raw traffic info, you have to export it from the firewall before it is processed.