PlaybookWhich syslog solution should I pick? (by scenario)
safe intermediate #recommendation#graylog#rsyslog#fortianalyzer#wazuh#decision
When to use this: You need to recommend a setup and justify it by size, budget and what the customer wants to do with the logs.
Before you start
Recommendations by scenario
These are starting points to confirm against current vendor documentation and prices.
| Scenario | Suggested setup | Why | Watch out |
|---|---|---|---|
| Lab / learning, 1 FortiGate | Ubuntu VM on your PC (VMware Workstation) with rsyslog | Free, light, teaches the real thing | PC off = no logs |
| Small office, just keep logs (compliance) | Small Ubuntu VM or mini PC, rsyslog, daily files, cron cleanup | Cheapest, simplest, easy to audit | Searching is manual (grep) |
| Small office, wants search and dashboards | Ubuntu + Graylog Open (Docker) | Free web UI, syslog input built in | Needs more RAM; check Graylog’s requirements |
| Windows-only team, no Linux skills | Visual Syslog Server (free) or Kiwi Syslog Server (commercial) on a Windows machine that stays on | Familiar OS and GUI | Less scalable; keep the host patched and always on |
| Fortinet-only, vendor support wanted | FortiAnalyzer (hardware or VM), optionally with an rsyslog copy as backup | Native reports and Fortinet parsing | Licensed per capacity; get a reseller quote |
| Security monitoring and alerts | Wazuh (free) or a commercial SIEM | Detection rules, correlation | Heavier, needs sizing and tuning |
| Remote sites / cloud-hosted | EC2 Ubuntu + rsyslog or Graylog, logs sent through an IPsec tunnel | Always on, no on-prem hardware | Do not expose 514 to the internet; running costs |
| Large estate (100+ devices) or strict compliance | Commercial SIEM or an Elastic/OpenSearch cluster, with HA and a design phase | Scale, support, reporting | This needs proper sizing, not a quick install |
A quick way to decide
- Only keep logs? rsyslog.
- Need to search and chart? Graylog Open (or FortiAnalyzer if Fortinet-only and budget allows).
- Need security alerts? Wazuh or a commercial SIEM.
- Where? A small always-on VM beats a PC. Cloud if there is no suitable on-prem host.
- How long? Retention drives disk, which drives cost.
How to verify it worked
- Your recommendation names a software, a place to host it, a retention plan and an estimated cost.
Common errors and fixes
Recommending a full SIEM when the customer only needs retention Start at the lowest level that meets the requirement (see the ladder scenario). Over-building costs money and admin time.
Recommending a laptop or desktop as the server Use something that stays on with a fixed IP: a VM, a mini PC or a cloud instance.
Q&A
Cheapest sensible setup for one FortiGate and a 90-day retention need?
An Ubuntu VM with rsyslog writing per-day files, a cron job to compress and delete old files, and a disk sized for the volume. Software cost is zero.
When does FortiAnalyzer make sense?
When the estate is mostly Fortinet, the customer wants Fortinet-specific reports and vendor support, and budget allows a licensed product. It is not a general-purpose syslog server for everything else.
When is Graylog a better fit than rsyslog alone?
When people need to search and chart logs through a web UI instead of using grep on files.