Configuring the Syslog Service on Fortinet devices

To configure the Syslog service in your Fortinet devices (FortiManager 5.0.7 and above) follow the steps below:

1. Login to the Fortinet device as an administrator.
2. Define the Syslog Servers either through the GUI System Settings > Advanced > Syslog Server or with CLI commands:
   
   Copy to Clipboard

   config system syslog

   edit <server name>

   set ip <Syslog server IP>

   end

3. Enable sending FortiManager local logs to the EventLog Analyzer server via CLI.
   config system locallog syslogd setting
   set syslog-name < Remote syslog server name, defined at previous step>
   set severity <emergency | alert | critical | error | warning | notification | information | debug> (Least severity level to log)
   set status <enable | disable>
   set csv Whether to enable CSV.
   set facility Which facility for remote syslog.
   set port Port that server listens at.
   end

Once you have completed the configuration steps, the logs from your Fortinet device will be automatically forwarded to the EventLog Analyzer server.

For more details and for other versions, refer source: http://kb.fortinet.com/kb/documentLink.do?externalID=FD35387