Collector Syslog Guide

1. Confirm the Collector Listener

On the collector machine, confirm the collector status shows the syslog listener as running and note the configured IP and UDP port. By default this is:

If your collector is configured to listen on a specific address or port, use that value instead.

1a. Multiple Collectors on One Windows Host

Each syslog-enabled collector on the same Windows host needs its own non-conflicting local listener IP/UDP port. Two collectors cannot both bind the same local address and port.

For example, one collector might use UDP 2216 and another UDP 2217. These are examples only: use the listener address and port configured for each collector, then point the corresponding FortiGate at that destination.

2. Configure FortiGate Syslog Destination

Point the FortiGate syslog configuration at the collector host and UDP port. Set the source IP to the same FortiGate address that ConfigSentry stores for the appliance, or to an address returned by that appliance hostname.

config log syslogd setting
  set status enable
  set server "x.x.x.x"
  set source-ip y.y.y.y
end

x.x.x.x is the collector host. y.y.y.y is the FortiGate source address and should match the appliance address ConfigSentry recognises. The source-ip command is available on newer FortiOS releases and may be unavailable when ha-direct is enabled.

3. Configure the Required Free-Style Filter

FortiGate should send only the configuration-change events needed by the collector. Use the free-style filter below:

config log syslogd filter
  config free-style
    edit 99
      set category event
      set filter "(logid 0100044546 0100044547)"
      set filter-type include
    next
  end
end

4. Relevant FortiGate Log IDs

The collector listens for these FortiGate configuration-change event log IDs:

• 0100044547 – LOGID_EVENT_CONFIG_OBJATTR – object created / modified / deleted
• 0100044546 – LOGID_EVENT_CONFIG_ATTR – global / system attribute changed

5. Example Event Payloads

Example object-change event:

date=2025-04-10 time=05:01:53 eventtime=1744286513150014241 tz="-0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(10.32.22.115)" action="Add" cfgtid=126746708 uuid="961e8b5a-1603-51f0-e0c5-204b0b600edc" cfgcomment="test" cfgpath="firewall.policy" cfgobj="8" cfgattr="name[testconfig]srcintf[port5]dstintf[port1]action[accept]srcaddr[all]dstaddr[all] schedule[always]service[ALL]nat[enable]" msg="Add firewall.policy 8"

Example system/global attribute-change event:

date=2025-04-10 time=05:23:12 eventtime=1744287792378243085 tz="-0700" logid="0100044546" type="event" subtype="system" level="information" vd="root" logdesc="Attribute configured" user="admin" ui="jsconsole(10.32.22.115)" action="Edit" cfgtid=821297153 cfgpath="system.global" cfgattr="admintimeout[5->120]" msg="Edit system.global "

6. What the Collector Does

The collector matches the actual UDP source address against the configured appliance address. A literal appliance IP is matched directly; a configured hostname remains supported through hostname resolution. Values contained inside the syslog payload, such as a device name or serial number, are not used as a substitute for source identity.

Events from a matched appliance can show syslog activity even when they are unrelated to configuration changes. Only supported configuration-change events can request a collection. The collector never guesses when the source cannot be matched safely, and duplicate/burst protection reduces repeated collection attempts.