Logging to multiple Syslog servers VDOM

[jonathanaxford]

Hi All, 

Fortigate 60D v5.2.4(Build688)

I've had a bit of a google and it appears it should be possible to setup my VDOMs to log to multiple Syslog servers, but I am struggling to find out how to get this working. 

I have overridden the global syslog settings to allow me to log per VDOM and this is working. Under the global config I get the option to configure syslogd, syslogd2 and syslogd3, but under the VDOM, I only get the option for syslogd. 

VDOM options:

FIREWALL (root) # config log custom-field Configure custom log fields. eventfilter Configure log event filters. fortianalyzer Configure first FortiAnalyzer device. fortiguard Configure log for FortiGuard. gui-display Configure log GUI display settings. memory Configure memory log. setting Configure general log settings. syslogd Configure first syslog device. threat-weight Configure threat weight settings.

Global options:

FIREWALL (global) # config log fortianalyzer Configure first FortiAnalyzer device. fortianalyzer2 Configure second FortiAnalyzer device. fortianalyzer3 Configure third FortiAnalyzer device. fortiguard Configure log for FortiGuard. memory Configure memory log. syslogd Configure first syslog device. syslogd2 Configure second syslog device. syslogd3 Configure third syslog device. webtrends Configure Web trends.

Am I missing something? 

Any help much appreciated, 

Cheers

Jon

[emnoc · Accepted solution]

It's doable and little hidden

You have to enable it ; and then magically you can set the server ;)

config log syslogd override-setting

    set override enable  <----HERE

    set status enable  <----HERE

    set server "10.1.1.31"  <-----HERE

end

[Jeff_FTNT]

Hello,

Each VDOM it can set up override syslog like CLI:config  log  syslogd  override-setting , it only can set up one.

Only this specific VDOM log sends to override syslogs.

On global, it can set up 3 syslog  server , all VDOM log will send to 3 different syslog server through Management VDOM, thanks.

[emnoc · Accepted solution]

It's doable and little hidden

You have to enable it ; and then magically you can set the server ;)

config log syslogd override-setting

    set override enable  <----HERE

    set status enable  <----HERE

    set server "10.1.1.31"  <-----HERE

end

[randomcatperson]

Thanks for this. Was what I needed.

[Medson1989]

Hello ,

In case of SYSLOG and other services that using specific ports.

Do we need to open the port and configure policy ?

In which cases we need policy for them ?

thanks

[DW_FTNT · Accepted solution]

6.2 has a new feature for this

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/972129/multiple-fortianalyzer-or-sys...

[DJ]

Exactly what we were looking for... thanks