Log Exporter Sends Only a Few Syslog Blade Events to FortiAnalyzer and Exported Messages differ

[Nikolas135096]

Hello everyone,

I am trying to forward events from the Syslog Blade to a FortiAnalyzer using Log Exporter, but I am encountering some unexpected behavior.

My setup:

• On the Security Gateway, I have configured Syslog messages to be forwarded to the Management Server.
• On the Management Server, I have configured a Log Exporter instance that sends logs to the FortiAnalyzer.
• The Log Exporter is filtered to export only logs of type Syslog.

Issue:

Only a very small number of Syslog events are actually exported to the FortiAnalyzer, even though many more Syslog logs are visible in SmartConsole.

In addition, some of the messages that do arrive on the FortiAnalyzer appear to be significantly different from the corresponding entries shown in the original logs within SmartConsole.

I have attached screenshots showing:

• The Log Exporter filter configuration
• The messages received by the FortiAnalyzer
• The corresponding log entries in SmartConsole

Any recommendations would be greatly appreciated.

Thank you in advance.

Best regards,
Niko

[simonemantovani]

You could try to perform a tcpdump on the management server and capture the traffic to the Fortianalyzer, and verify which logs are forwarded to the FAZ, in this way you'll verify if all the logs displayed on the smartconsole are also forwarded, and have a confirmation that the Log Exporter configuration is fine.

[Nikolas135096]

Thank you very much for your feedback. Sorry I forgot to post an update. A tcpdump showed that, in fact, only the messages displayed are exported.

[simonemantovani]

I apologize ... could you post an example of an event that is forwared to FAZ and one that is not forwared?

[Nikolas135096]

For sure. Primarily, the "Clock Daemon" messages are forwarded, as well as the "CheckPoint Syslog started" messages, which are not visible in SmartConsole (Screenshot 3).

[PhoneBoy · Accepted solution]

Suggest involving TAC here.

[Nikolas135096]

Thanks!