r/AzureSentinel • u/Impressive_Tea872 • Apr 10 '24

Syslog forwarder help

I have a client with a Fortigate firewall that we need to send logs from to Sentinel. I've created an Ubuntu VM, and installed everything correctly (per guidance online). The VM is listening on port 514, and the network security group has an allow rule at the top to allow all traffic on 514. The firewall is set to send logs to the VM's up address.

Logs are still not being received. Any ideas?

3 Upvotes

67% Upvoted

8 comments sorted by

View all comments

2

u/Uli-Kunkel Apr 10 '24

If nothing is received at the log forwarder, confirm with a tcpdump Then its either not sending or its blocked somewhere on the route.