Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Offloading is a common process in information systems with limited audit storage capacity.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
For audit log resilience, it is recommended to log to the local FortiGate disk, and two central audit servers. To configure this, log in to the FortiGate GUI with Super-Admin privilege.
1. Click Log and Report.
2. Click Log Settings.
To add a FortiAnalyzer server:
3. Scroll to Remote Logging and Archiving, toggle the Send logs to FortiAnalyzer/FortiManager setting and enter the appropriate IP address.
To add a syslog server:
4. Scroll to Remote Logging and Archiving, toggle the Send logs to syslog setting, and enter the appropriate IP address.
5. Click Apply to save the settings.
or
1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config log fortianalyzer setting
# set status enable
# set server {IP Address}
# set upload-option realtime
# end
# config log syslogd setting
# set status enable
# set server {IP Address}
# set mode reliable
# end
Note: The central audit server can be a FortiAnalyzer, a syslog server, or one of each.