Playbook
Home / Logging & Syslog / Connect sources

FortiGate: which logs get sent (policy logging and filters)

careful intermediate #fortigate#logtraffic#severity#filter#traffic log#event log

When to use this: The syslog server receives only some logs, or too many, and you want to control what the FortiGate generates and sends.

Be careful with this one. Logging every session raises log volume and CPU/disk use. Increase logging deliberately and watch disk growth.

Before you start

Steps

  1. Control traffic logging per firewall policy

    terminal
    config firewall policy
    edit 1
        set logtraffic all
    next
end

    Replace 1 with the policy ID. all logs every session, utm logs only sessions that trigger security profiles, disable logs none. Without this, the firewall may generate no traffic logs for that policy at all.

  2. Review what a policy currently does

    terminal
    show firewall policy 1

    Look for set logtraffic in the output. A policy that has no line may be using a different default for your version.

  3. Optionally limit what is forwarded by severity

    terminal
    config log syslogd filter
    set severity information
end

    Forwards messages at that severity and more serious ones. Use set severity ? to see the allowed levels. This setting lives under the syslog filter, separate from the destination server.

  4. Check the volume afterwards

    After a day, check the growth of the server's folder for this device (du -sh). Adjust policy logging or filters if the volume is higher than your disk plan.

How to verify it worked

  • Traffic through the policy generates log lines on the syslog server, and the chosen severity levels appear.

How to undo it

Return a policy to utm-only logging:

terminal
config firewall policy
    edit 1
        set logtraffic utm
    next
end

Common errors and fixes

Only event logs arrive, no traffic logs Policy logging is off. Set logtraffic on the policies you care about.
Volume is far higher than planned logtraffic all on busy policies, especially internet access. Log only the policies that matter or use utm, and size the disk accordingly.
Filter command not found The location of filter settings differs by FortiOS version. Press ? after config log syslogd to list the available sub-commands.

Q&A

Why do I get no traffic logs even though syslog works?

Syslog only forwards what is generated. Enable traffic logging on the policies.

What does logtraffic utm do?

Logs only sessions that match security profile inspection. all logs every session, which is much more data.

Practice these as flashcards →

Terms in this scenario

SeverityFacilityEPS (events per second)

Related scenarios

My notes

Saved in this browser only.