# Fortinet/Fortigate - TCP Raw Input and delimiter

**URL:** <https://community.graylog.org/t/fortinet-fortigate-tcp-raw-input-and-delimiter/17184>\
**Category:** Graylog Central (peer support)\
**Created:** [September 16, 2020, 4:17am UTC](https://community.graylog.org/t/fortinet-fortigate-tcp-raw-input-and-delimiter/17184 "2020-09-16T04:17:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sylvain](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@Sylvain](https://community.graylog.org/u/Sylvain)\
**Post date:** [September 16, 2020, 4:18am UTC](https://community.graylog.org/t/fortinet-fortigate-tcp-raw-input-and-delimiter/17184/1 "2020-09-16T04:18:00Z")

</div>

Hello Graylog community,

I’m trying to collect logs from Fortinet firewalls.  
Currently configured in UDP, working well.  
I have to switch to TCP+TLS for secure log collection.  
The problem come is when I switch to TCP, messages are not recognize by Graylog because of the lack of delimiter (from Fortinet ?)…

So, with newline delimiter, if I start/stop the input I get one BIG message containing several messages.  
If I understood well, in TCP the newline delimiter can’t work due to the transport itself.

If I use a ‘NULL delimiter’ in the input configuration, message are delimited, but like a delimiter is present in the middle of the message (messages are in CEF format).

Example : raffi:orwar server-rst|3|deviceExternalId=( CONTENT OF THE MESSAGE) CEF:0|Fortinet|Fortigate|v6.4.1|0013  
So yes the “CEF:0” which is supposed to be at the begin of the message is nearly at the end…

There is something that I can do on Graylog side to solve that ? Is it possible to delimit the message at the input (extractor) level ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 30, 2020, 4:18am UTC](https://community.graylog.org/t/fortinet-fortigate-tcp-raw-input-and-delimiter/17184/2 "2020-09-30T04:18:01Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.