Playbook
Home / Logging & Syslog / Connect sources

Send FortiGate logs to a syslog server

careful intermediate #fortigate#fortinet#syslogd#firewall#cli#source-ip

When to use this: You have a FortiGate firewall and want its logs delivered to your syslog server.

Be careful with this one. Changing log settings is low risk, but a wrong source IP or interface can silently send nothing. Always verify on the wire.

Before you start

Steps

  1. Check the FortiGate can reach the server

    terminal
    execute ping-options source 192.168.1.1
execute ping 192.168.1.10

    Replace the first IP with the FortiGate interface address you want to send from and the second with the syslog server. If this fails, fix routing or firewalling first.

  2. Configure the syslog destination (CLI)

    terminal
    config log syslogd setting
    set status enable
    set server "192.168.1.10"
    set mode udp
    set port 514
end

    Enables remote syslog to 192.168.1.10. mode udp is the default. This is the minimal working configuration.

    GUI equivalent in FortiOS 7.4 and later: Log & Report, Log Settings, Global Settings, Syslog Logging. The menu path differs in older versions.

  3. Optional: choose the source address

    terminal
    config log syslogd setting
    set source-ip "192.168.1.1"
end

    Syslog is treated as management traffic and leaves through the unit's routing, or its dedicated management interface if one is configured. Setting source-ip makes messages come from a known address so the server's allow-list matches. FortiOS 7.6 and later also offer set source-ip-interface <name>.

  4. Optional: reliable (TCP) delivery

    terminal
    config log syslogd setting
    set mode reliable
    set port 514
end

    reliable uses RFC 6587 TCP syslog. legacy-reliable is the older RFC 3195 variant. The server must listen on TCP on the same port. FIPS-CC mode defaults to TCP 601.

  5. Optional: send through an IPsec tunnel

    terminal
    config log syslogd setting
    set interface-select-method specify
    set interface "<IPsec tunnel interface>"
end

    Forces the syslog traffic out of a named interface, for example a VPN to a cloud server.

  6. Make sure traffic is actually being logged

    Syslog only forwards logs the FortiGate generates. Policies need logging enabled (see the logging scenario). Event logs (admin logins, config changes) are usually generated by default.

  7. Verify on the FortiGate side

    terminal
    diagnose sniffer packet any 'host 192.168.1.10 and port 514' 4 0 l

    Shows packets leaving towards the server. Press Ctrl+C to stop. If you see packets going out, the problem is on the server or the path; if you see none, the FortiGate is not generating or routing them.

  8. Verify on the server

    terminal
    sudo tcpdump -ni any host 192.168.1.1 and port 514
sudo tail -f /var/log/remote/192.168.1.1/$(date +%Y-%m-%d).log

    Replace 192.168.1.1 with the FortiGate's source IP. Lines starting with date=... time=... devname=... are typical FortiGate log fields.

Syntax confirmed against Fortinet Community technical tips (updated 2026) for the basic setup, source IP, tunnel, reliable mode and the 7.6 source-ip-interface option. Options such as format, facility and severity filters vary by FortiOS version, so list them with ? on your unit or check the FortiOS CLI reference.

How to verify it worked

  • The server's sender folder for the FortiGate fills with new lines.
  • A deliberate event (e.g. an admin login) shows up within seconds.

How to undo it

Disable remote syslog:

terminal
config log syslogd setting
    set status disable
end

Common errors and fixes

Packets leave the FortiGate but nothing is stored Server firewall, wrong port, or rsyslog rule not matching the sender IP. Run tcpdump on the server and check ss -lunp.
Nothing leaves the FortiGate Check show log syslogd setting for status enable and the correct server, that policies log, and routing to the server (use the ping test with the same source).
Server sees a different IP than expected NAT, a different outgoing interface, or no source-ip set. Set source-ip or allow the address you actually see.
Messages in the wrong format Check the format options with set format ? in config log syslogd setting for your FortiOS version and match your collector's parser (default, CSV, CEF, JSON and others may be offered).

Q&A

What is the default FortiGate syslog port and protocol?

UDP 514. In FIPS-CC mode the default is TCP 601.

How do I send to more than one syslog server?

FortiGate provides syslogd, syslogd2, syslogd3 and syslogd4 settings, each with its own server.

What are the mode options?

udp, legacy-reliable (RFC 3195) and reliable (RFC 6587 TCP).

Which command proves the FortiGate is sending?

A packet capture: diagnose sniffer packet any 'host <server> and port 514' 4 0 l.

Practice these as flashcards →

Terms in this scenario

Syslog serverFacilitySeverity

Related scenarios

My notes

Saved in this browser only.