Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kiclee
New Contributor II

I would like to send all logs to a Splunk to use syslog.

Hello,

 

I would like to send all logs a Splunk to use syslog.

I had done to set Splunk IP on syslog server of log setting and set All sessions of logging options on the all rules.

However, the Splunk has been getting only IPS logs, not all session logs.

 

Can you tell me what i should do to check or resolve it?

 

Thanks and Regards,

Kic Lee

1 REPLY 1
kiclee
New Contributor II

I hope it would be helpful to someone.

My FW was set to send syslog when severity of log is equal or high than warning.

Denied traffic logs are classified warning of severity.

Allowed traffic logs are classified notice of severity.

 

So It has been working well after changed the configuration from warning to notice.

 

Good luck.

Labels
Top Kudoed Authors