Fortinet Log Forwarding

Complete guide to configuring Fortinet FortiAnalyzer log forwarding modes, including Forwarding Mode and Aggregation Mode setup.

Overview

FortiAnalyzer supports two mechanisms for sending logs to another server:

• Forwarding Mode – Client-only configuration; server requires no setup.
• Aggregation Mode – Requires configuration on both client and server; designed for centralized log collection.

This document describes configuration steps, parameters, and behavior for both modes.

Forwarding Mode

Summary

• Enabled from GUI.
• No configuration required on the receiving server.
• Sends logs in real-time or periodic intervals based on settings.
• Supports forwarding to FortiAnalyzer, Syslog, or CEF servers.

Configuring Forwarding Mode (Client Side – GUI)

Steps

1. Navigate to: System Settings → Log Forwarding
2. Click Create New.
3. In the Create New Log Forwarding panel, fill in the fields described below.
4. Click OK to enable log forwarding.

Configuration Fields

Log Forwarding Filters

Device Filters

• Click Select Device to choose which devices will forward logs.

Log Filters

• Turn ON to filter forwarded logs.
• Choose All or Any conditions.
• Add filter rules:
  • Log Field → Match Criteria → Value

Exclusions (Syslog/CEF only)

• Turn ON to exclude certain logs.
• Specify:
  • Device Type
  • Log Type
• Add excluded log fields under Fields → Select Log Field.

Device Registration Notes

Devices forwarding logs to another FortiAnalyzer appear as unregistered on the receiving server.

Aggregation Mode

Summary

• Configured only via CLI.
• Requires server-side acceptance of log aggregation.
• Designed for hierarchical FortiAnalyzer deployments.

Checking Existing Log Forwarding Entries

Use this command on the client to view configured IDs:

get system log-forward

Server-Side Configuration

1. Ensure a Super_User admin exists

   • If not, create one.

2. Enable log aggregation

   config system log-forward-service
       set accept-aggregation enable
       set aggregation-disk-quota <quota>     # Optional
   end

   aggregation-disk-quota defines storage allowed for aggregated logs.

Client-Side Configuration (CLI)

1. Enter log-forward shell

   config system log-forward

2. Create or edit a forwarding entry

   edit <log_forwarding_ID>

3. Set mode to aggregation

   set mode aggregation

4. Configure server details

   set server-name <server_display_name>
   set server-ip <xxx.xxx.xxx.xxx>

5. Enter authentication credentials

   These belong to the Super_User admin created on the server.

   set agg-user <username>
   set agg-password <password>

6. (Optional) Set aggregation time

   • Value: 0–23 hours
   • Default: 0 (midnight)

   set agg-time <hour>

7. Apply configuration

   end

   After success, FortiAnalyzer displays:

   check for cfg[<log forwarding ID>] svr_disp_name=<server-name>

Summary Comparison

Create New Log Forwarding