FortiAnalyzer Integration via Syslog

Purpose

This guide explains how to forward logs from Fortinet FortiAnalyzer to Logsign USO over Syslog. FortiAnalyzer collects logs from the Fortinet devices registered to it and can relay them onward, so a single forwarding definition can carry records from several different Fortinet products at once. Logsign recognizes which product each relayed record actually came from and applies that product's own parser, so product-specific fields and event mappings resolve correctly instead of everything being read as FortiGate traffic.

Prerequisites

• A FortiAnalyzer with administrative access and the Fortinet devices whose logs you want to collect already registered to it.
• Network connectivity from FortiAnalyzer to Logsign over Syslog (UDP/TCP, port 514 by default, or your organization's configured Syslog port).

Step 1: Configure Log Forwarding on FortiAnalyzer

In the FortiAnalyzer administrative interface, create a log forwarding entry that sends logs to the Logsign collector's IP address and port in Syslog format. The exact menu path depends on your FortiAnalyzer version; consult your Fortinet administrator or Fortinet's own documentation for the log forwarding screen on your release. This step was not independently re-verified against a live FortiAnalyzer console during this research. Only the log format FortiAnalyzer actually sends and the Logsign-side parser were confirmed from source.

Forward the logs in their original key-value form rather than reformatting them. Logsign identifies the originating product from fields the device itself writes, so a transformed or reduced payload can prevent the correct product parser from being selected. If FortiAnalyzer prepends its own header to the relayed record, Logsign strips that header before parsing, so no special handling is required on the FortiAnalyzer side.

Step 2: Add FortiAnalyzer as a Device in Logsign USO

1. In Logsign USO, go to Data Collection and click +Device.
2. Select Syslog as the collection type and FortiAnalyzer as the device/plugin.
3. Enter the FortiAnalyzer's IP address as the source, give the device a name, and save.

Define the source once for the FortiAnalyzer itself. You do not add a separate device for each Fortinet product behind it; the records are separated automatically after they arrive.

How Relayed Products Are Recognized

Every record relayed through FortiAnalyzer is inspected before parsing. Logsign first reads the device serial number the record carries in its devid field, because the serial's prefix identifies the product family.

When a record carries no recognizable serial, Logsign falls back to the shape of the record itself. A FortiWeb record is identified by its log identifier together with FortiWeb-specific fields such as the requested URL or server pool name. A FortiMail record is identified by its comma-separated date and time header. A FortiAuthenticator record is identified by its category, subcategory and type identifier appearing together.

FortiGate records, and any record whose product cannot be determined, are parsed by the FortiAnalyzer parser itself (EventSource Prefix ID 4245), which reads the FortiGate key-value schema.

Notes and Limits

• Product detection reads the record's own top-level key-value pairs, not the raw text of the line. Device management events that quote a foreign serial number inside a message body therefore do not cause a record to be routed to the wrong product.
• The dev_id field is deliberately not used for detection, because on FortiWeb it carries a certificate hash rather than a device serial.
• Each relayed product keeps its own EventSource Prefix ID, so searches and reports can distinguish FortiWeb, FortiMail, FortiSandbox and FortiAuthenticator events from FortiGate events even though they all arrive through the same FortiAnalyzer source.
• If you collect a Fortinet product through FortiAnalyzer whose records are not being recognized, contact Logsign support with a raw sample so the detection rules can be extended.