FortiAnalyzer send Alarm / Incident if a FortiGate send no logs

 Problem

A FortiAnalyzer logs various FortiGates. To simplify the daily work of the administrator, he does not want to check every morning whether all FortiGates logs are really sent to the FortiAnalyzer.

How can it be ensured that the FortiAnalyzer triggers an "alarm" as soon as a FortiGate does not send a log file for a certain time?

Solution

Create a local log entry when a device is not sending data

Via the CLI you can configure if the FortiAnalyzer creates a local log entry if a device does not send log entries for a certain time.

Furthermore, there are a few more helpful options which are presented here.

config system locallog settings
    set log-interval-dev-no-logging 15
    set log-interval-disk-full 1440
    set log-interval-gbday-exceeded 720
end

• log-interval-dev-no-logging: Interval in minute for logging the event of no logs received from a device. 0 is default and disable the log entry
• log-interval-disk-full: Interval in minute for logging the event of disk full. 0 is default and disable the log entry
• log-interval-gbday-exceeded: Interval in minute for logging the event of the GB/Day license exceeded. 0 is default and disable the entry.

In this example, a local log entry is created every 15 minutes as soon as a device has not delivered any data.

Create FortiAnalyzer Event-Handler 

Next, we create a FortiAnalyzer event handler to catch the generated local log entry.

Verify

Comming soon.