Collector Syslog Guide

1. Confirm the Collector Listener

On the collector machine, confirm the collector status shows the syslog listener as running and note the configured IP and UDP port. By default this is:

If your collector is configured to listen on a specific address or port, use that value instead.

2. Configure FortiGate Syslog Destination

Point the FortiGate syslog configuration at the collector host and UDP port. Set the source IP to the same FortiGate address that ConfigSentry stores for the appliance, or to an address returned by that appliance hostname.

config log syslogd setting
  set status enable
  set server "x.x.x.x"
  set source-ip y.y.y.y
end

x.x.x.x is the collector host. y.y.y.y is the FortiGate source address and should match the appliance address ConfigSentry recognises. The source-ip command is available on newer FortiOS releases and may be unavailable when ha-direct is enabled.

3. Configure the Required Free-Style Filter

FortiGate should send only the configuration-change events needed by the collector. Use the free-style filter below:

config log syslogd filter
  config free-style
    edit 99
      set category event
      set filter "(logid 0100044546 0100044547)"
      set filter-type include
    next
  end
end

4. Relevant FortiGate Log IDs

The collector listens for these FortiGate configuration-change event log IDs:

• 0100044547 – LOGID_EVENT_CONFIG_OBJATTR – object created / modified / deleted
• 0100044546 – LOGID_EVENT_CONFIG_ATTR – global / system attribute changed

5. Example Event Payloads

Example object-change event:

date=2025-04-10 time=05:01:53 eventtime=1744286513150014241 tz="-0700" logid="0100044547" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI(10.32.22.115)" action="Add" cfgtid=126746708 uuid="961e8b5a-1603-51f0-e0c5-204b0b600edc" cfgcomment="test" cfgpath="firewall.policy" cfgobj="8" cfgattr="name[testconfig]srcintf[port5]dstintf[port1]action[accept]srcaddr[all]dstaddr[all] schedule[always]service[ALL]nat[enable]" msg="Add firewall.policy 8"

Example system/global attribute-change event:

date=2025-04-10 time=05:23:12 eventtime=1744287792378243085 tz="-0700" logid="0100044546" type="event" subtype="system" level="information" vd="root" logdesc="Attribute configured" user="admin" ui="jsconsole(10.32.22.115)" action="Edit" cfgtid=821297153 cfgpath="system.global" cfgattr="admintimeout[5->120]" msg="Edit system.global "

6. What the Collector Does

The collector first matches the UDP source address against literal appliance IPs and every address currently returned for configured appliance hostnames. If the transport address differs, it can also use a known FortiGate serial number or device name from the event.

The collector never guesses when no unique appliance can be identified. It records the unknown or ambiguous source IP on the collector page and applies a short cooldown per appliance to avoid repeated collections during a burst of configuration-change messages.