Collector Requirements

1. Network and Access

• Unproxied outbound HTTPS access to https://projectx.float-zone.com/configsentry/.
• Connectivity to each configured appliance host and SSH port.
• SSH credentials with sufficient privilege to read the full configuration. Recommended role: Read-Only Admin.

1a. Collector Security Model

• Use the lowest practical privilege that still allows full configuration retrieval.
• Where a setting is marked Enter Locally, the secret is intended to remain on the collector host instead of being stored as a website-managed secret value.
• Website communication is designed around outbound HTTPS from the collector host. If you enable syslog-triggered collection, separate inbound syslog traffic to the collector host is also part of that workflow.
• If your review requires current deployment, package-trust, or platform storage-architecture details, contact secdit directly rather than inferring them from this page.

2. Windows Collector

• Windows 10 / 11, or Windows Server 2019 or later.
• Administrator permission to install and manage the per-home Windows Service.
• Permission to allow the collector syslog listener through Windows Firewall if syslog-triggered collection is enabled.
• For a new installation, the legitimate Collector Config JSON for that collector.

Windows collectors share one machine-wide ConfigSentry runtime. Individual collectors retain separate configuration, logs, state, identity, and Windows Services beneath the selected machine installation location. The Windows runtime is native and does not require PHP.

3. Linux / FreeBSD Collector Scripts

• php-cli installed and available on PATH.
• Either curl or wget installed.
• Either bsdtar, tar with .tar.gz support, or PHP ZIP support as required by the current runtime package.
• Permission to install a cron entry for the collector watchdog.

4. Syslog-Triggered Collection

The collector can listen for FortiGate configuration-change syslog messages and trigger a targeted collection run.

• Default listener: 0.0.0.0:2216 (UDP).
• The listen IP and UDP port can be configured from the collector page or entered locally.
• When multiple syslog-enabled collectors run on one Windows host, each needs a non-conflicting local listener IP/UDP port.
• If syslog-triggered collection is enabled, the collector service must be left running continuously.

5. FortiGate Syslog Configuration

Apply these commands on your FortiGate to send config-change syslog events to the collector. Replace syslogd with syslogd2, syslogd3, or syslogd4 to use a different syslog server slot.

config log syslogd setting
  set status enable
  set server "[collector server ip]"
  set port [custom port]
end

config log syslogd filter
  config free-style
    edit 99
      set category event
      set filter "(logid 0100044546 0100044547)"
    next
  end
end

The set port line is only required when using a custom port; omit it to use the Collector default port 2216. On a multi-vdom firewall, run these commands under the config global context.

6. Operational Notes

• The collector service should remain enabled so scheduled collections and syslog-triggered collections can run automatically.
• If the collector is not running continuously, syslog-triggered collection will not work.
• Collector updates and config updates are downloaded from the secdit website according to the collector settings.
• Collector deployment usually needs internal approval for host placement, FortiGate read-only access, outbound connectivity, and any inbound syslog allowance.

7. Windows Updates and Legacy Installations

To manually update a current Windows shared-runtime installation, download and run the newer ConfigSentry Windows MSI. Do not supply the Collector Config JSON again; existing collectors and their configuration are preserved.

An incompatible legacy Windows collector cannot be migrated automatically. Retain or download the required Collector Config JSON, uninstall the old collector, then use the current installer for a fresh installation.

8. Related Trust and Security Information

• Security & Trust
• ConfigSentry FAQ
• Privacy Policy