FortiGate logs not showing in Wazuh

grep 'devname=' /var/ossec/logs/archives/archives.log | tail -n 3

grep log_alert_level /var/ossec/etc/ossec.conf

Why it happens

Cause 1: traffic logs sit at level 1

In ruleset/rules/0391-fortigate_rules.xml on 4.14.7, rule 81618 matches any FortiGate log with type=traffic at level 1. It does not look at action, so denied and allowed sessions land on the same rule. The default <log_alert_level> in ossec.conf is 3. The only traffic rule above it is 81619, level 3, after 18 traffic events from one source within 45 seconds.

We sent one denied-traffic line (action="deny", SSH from outside to an internal host) and one Admin login failed line over UDP syslog to a 4.14.7 manager. alerts.json got the login failure (rule 81606, level 4) and nothing for the denied session.

Cause 2: CSV format corrupts srcip

The stock decoder reads key=value pairs separated by spaces. In CSV format the separator is a comma, so the capture for srcip runs to the next space. Measured over UDP on 4.14.7, the login-failed event in CSV format produced an alert whose data.srcip was:

203.0.113.5,dstip=192.168.1.99,action="login",status="failed",...

The rule still fires, but the address is not an address: GeoIP, <same_source_ip> correlation and active response (firewall-drop) all read srcip.

Fix

1. Send the default format. On the FortiGate CLI, for the syslog server Wazuh listens on:

config log syslogd setting
    set format default
end

(syslogd2, syslogd3… for additional servers.) FortiOS also offers cef and rfc5424; we have not measured those against the stock decoders.

2. Raise denied traffic to an alert. In /var/ossec/etc/rules/local_rules.xml:

<group name="local,fortigate,">
  <rule id="100210" level="5">
    <if_sid>81618</if_sid>
    <action>deny</action>
    <description>FortiGate: traffic denied by policy.</description>
    <group>firewall_block,</group>
  </rule>
</group>

On 4.14.7 this loaded cleanly, and the same denied line that produced nothing produced a level 5 alert with srcip and dstport intact. Use an ID in your own range. An internet-facing FortiGate denies a lot; narrow it further (an interface, a port, a destination) if the volume is too high.

Write it with the <action> tag, not <field name="action">. action is a static field. With the <field> form, 4.14.7 logged ERROR: Failure to read rule 100210. Field 'action' is static. and the manager did not start: no alerts at all, not only for FortiGate.