Log Collection, Parsing, and Storage
Log Collection, Parsing, and Storage tests the path from a FortiGate or syslog source to a searchable, retained log on FortiAnalyzer 7.4. You need to know the transport, the parser, the storage policy, and what happens when disk fills.
Collection paths
- FortiGate-to-FortiAnalyzer uses OFTP over TCP 514 by default, encrypted with SSL. The FortiGate setting is under
config log fortianalyzer setting; enable it, set the server, and choose realtime or store-and-upload. Store-and-upload keeps logs locally when the analyzer is unreachable and sends them later. - Syslog sources use UDP or TCP 514. Register the source as a syslog device and select a parser that matches its format.
- Only registered devices in the correct ADOM are accepted; an unregistered device's logs are dropped or not attributed.
Parsing
FortiAnalyzer parses logs by device type, log type, and subtype. The parser maps fields used by FortiView, reports, and event handlers. If the ADOM firmware version does not match the device, fields may be missing or logs may land in unparsed views. Custom syslog formats need a parser that extracts the fields you intend to search.
Storage and retention
Set a per-ADOM storage policy: retention days, quota, and auto-delete behavior. When the disk reaches its threshold, the oldest logs are deleted according to policy. RAID protects the log volume on hardware appliances; VM storage depends on the underlying datastore. Log files roll over, so retention and quota are separate controls. Back up or forward logs before shortening retention.
Worked example
A FortiGate is registered and sending traffic, but FortiView shows no application data. Check the ADOM version against the FortiGate firmware, confirm the log type is traffic (not only event), verify the FortiGate's FortiAnalyzer status is enabled and the server address is the HA virtual IP, then check storage policy and free disk. Reasoning: registration proves reachability, but parsing and storage determine whether the data is usable and retained.
Traps
- Assuming port 514 is only plain syslog; OFTP also uses TCP 514 but is SSL-wrapped.
- Registering a syslog device without choosing a parser.
- Setting retention without checking disk quota.
- Forgetting that auto-delete removes oldest logs first.
- Using an ADOM version that does not match the device firmware.