Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Integrate FortiGate firewalls with SolarWinds LEM

Integrate FortiGate firewalls with SolarWinds LEM

updated 10/10/2018


This KB article describes how to configure your Fortinet® FortiGate firewall to send syslog events to your SolarWinds Log and Event Manager (LEM). 

To integrate your FortiGate firewall with SolarWinds LEM: 

  1. Configure your FortiGate firewall settings. 
  2. Configure the FortiGate connector in your LEM Console.


  • All LEM versions
  • FortiGate firewalls running FortiOS 4.x/5.x/6.x

Configure your FortiGate firewall settings

Configure the FortiGate firewall settings for your specific FortiOS operating system.

Firewalls running FortiOS 4.x

Configure your FortiGate firewall running on FortiOS 4.x:

  1. Open your FortiGate Management Console.
  2. Navigate to Log & Report > Log Config > Log Settings. 
  3. Select the Syslog check box.
  4. Expand the Options section and complete all fields. 
    1. In the Name/IP field, enter the hostname or IP address of your LEM appliance.
    2. In the Port field, enter 514.
    3. In the Level field, select the logging level where FortiGate should generate log messages.

      SolarWinds recommends Level 6 - Information. This level provides the most comprehensive logging messages.

    4. In the Facility field, enter a specific syslog facility for the LEM appliance or accept the default.

      Do not select Enable CSV Format. Clear this option (if necessary).  

      The LEM connector matches the default value in FortiGate by default. If required, you can configure custom values in both areas. 

  5. Click Apply.

    Your firewall is configured. 

Firewalls running FortiOS 5.x/6.x

In FortiOS 5.x, you can only define a syslog server using a command line. If you defined virtual domains (VDOMs), run through the appropriate command for each VDOM. 

The system includes three sets of syslog settings you need to consider before conducting an overwrite. SolarWinds recommends identifying these settings first before you continue. 

config log {syslogd | syslogd2 | syslogd3} setting

config log {syslogd | syslogd2 | syslogd3} setting

config log {syslogd | syslogd2 | syslogd3} setting



See the FortiGate FortiOS CLI Reference for 5.0 Guide located on the Fortinet website for information about the following setting:

{syslogd |  syslogd2 | syslogd3}

To configure your firewall running FortiOS 5.x, open a command line and execute the following: 

config global

config log syslogd2 setting 

set status enable

set format default

set mode udp

set server <lem><lem/></lem>

set source-ip <ip><ip/></ip>

set facility < optional pick your facility from local0...7 (defaults to local7)>


See the FortiGate FortiOS CLI Reference for FortiOS 5.0 Guide for more information.




If no network/firewall related issue, you should be able to see the Log facility selected above ex:local7 growing on LEM side. This can be checked via Putty -> LEM -> appliance -> checklogs

Configure the FortiGate connector from your LEM Web Console

After you configure your FortiGate firewall settings, configure the appropriate FortiGate connector in your LEM Console. 

If you are running FortiOS 4.x, configure the FortiGate 2.8+ connector. If you are running FortiOS 5.x, configure the FortiGate 5.0+ connector. 

  1. Open your LEM Console and log in as an administrator.
  2. Click Manage and select Appliances.
  3. In the Appliances screen, click the "gear" drop-down menu next to your appliance and select Connectors.
  4. In the Search field, enter Fortigate.
  5. In the Connectors screen, locate the appropriate FortiGate connector for your FortiOS operating system.
  6. Click the "gear" drop-down menu next to the appropriate connector and select New. 

    The Connector Configuration window displays. 

  7. In the Alias field, enter a custom name or accept the default name. 
  8. In the Log field, verify that the path is pointed to the local facility configured in your device syslog settings.
  9. When you are finished, click Save.
  10. Click the "gear" drop-down menu next to your new connector (highlighted with an icon in the Status column) and select Start.
  11. Click Close to exit the Connector Configuration window. 

    Your FortiGate connector is configured in your LEM console. 

See Troubleshooting network devices logging to LEM for information about troubleshooting connectors and logging devices. 

Last modified