add syslog

README.md

@@ -18,6 +18,18 @@ Analyze local logs:
 fgai analyze-logs --logs logs/fg_syslog.jsonl
 ```
 
+Listen for FortiGate syslog locally:
+
+```bash
+fgai listen-syslog --port 5514 --output logs/fg_syslog.jsonl
+```
+
+UDP port `514` normally needs root privileges on Linux:
+
+```bash
+sudo .venv/bin/fgai listen-syslog --port 514 --output logs/fg_syslog.jsonl
+```
+
 Test FortiGate API access:
 
 ```bash
@@ -67,7 +79,7 @@ Example FortiGate syslog target, run on the FortiGate CLI and replace the server
 config log syslogd setting
     set status enable
     set server "192.0.2.50"
-    set port 514
+    set port 5514
     set mode udp
     set format default
 end