TABLE OF CONTENTS

• Overview
• Steps of Configuration
• Verification of Configuration
  • Using the UI
  • Using the CCE Server

Overview

The CCE (Collection and Control Engine) receives logs from FortiWeb using port 514 (UDP). Ensure that port 514 is allowed through the firewall.

Before logging into Syslog, you must enable it for the log type you want to use as a trigger. For more information, see Enabling log types, packet payload retention, & resource shortage alerts.

Steps of Configuration

1. Go to Log & Report > Log Policy > Syslog Policy.
   Note: Your administrator account must have Read and Write permissions for the Log & Report category. For details, see Permissions.
2. Click Create New.
   Note: If this is a new policy, enter a Policy Name that will be referenced in the configuration.
3. Click Create New again.
4. In the IP Address field, enter the address of the remote Syslog server.
5. In the Port field, enter the listening port number of the Syslog server. The default is 514.
6. Enable the CSV Format checkbox if you want log messages sent in comma‑separated value (CSV) format.
7. Click OK.
   

Verification of Configuration

Verification can be performed either from the CCE server or from the UI.

Using the UI

1. Log in to the UI and go to SYSTEM.
   
2. Select Logs and Flows Collection Status.
   
3. Under Source Device IP, confirm that the device IP is displayed.
   

Using the CCE Server

Run the following command to verify whether logs are being received:

sudo tcpdump -i any host 514 and host <IP address> -AAA