What is the difference between Log Forwarding and File Forwarding?

Short answer

Both carry the data produced by the device out of it, but different data in a different way. Log Forwarding sends the device logs (User Logs, Notification Logs, GTM Logs, Health Check Logs) as they occur, line by line, with Syslog to a Syslog server or a SIEM. File Forwarding, on the other hand, delivers the backup files to a destination with E-Mail, FTP or SCP when a backup is created; it is not a live stream but a transfer made as files are produced. Both are profile-based, can send to multiple destinations at the same time, and in a cluster their settings are synchronized to the peer device; each device does the sending separately for its own logs and its own backups.

Where It Is Used in TR7

Where	Field / label	What for
Settings → General Settings → Log Forwarding → Add	Transport Type (Syslog), Syslog Server, Log Sources	Streaming the logs instantly to a Syslog server or a SIEM
Bot/DDoS → L4 DDoS Protection → route table → Quarantine	Quarantine Log Forwarding	Sending the L4 DDoS quarantine entries to the selected Log Forwarding profiles (at most 5 profiles; independent of the Log sources selection)
Settings → General Settings → File Forwarding → Add	Transport Type (E-Mail default, FTP, SCP), Sources (Backup Files), Backup Types (Automatic, User)	Sending the backup files to the destination
Same form, FTP / SCP	Transfer Mode (Sync (mirror folder) / Single file), Sync Window (recent only)	Mirroring the backup folder to the remote side or sending only the new file
Settings → General Settings → File Forwarding (list)	Test, Sync Now	Trying the access to the destination; manually synchronizing an FTP/SCP profile in the Sync mode

Comparison

	Log Forwarding	File Forwarding
What it sends	Log records	Backup files
When	As logs occur	When a backup is created (also manually with Sync now)
Transport	Syslog (UDP or TCP)	E-Mail, FTP (with the FTPS option), SCP
E-mail infrastructure	Not used	For the E-Mail type, the E-mail settings (SMTP) in Notification Management
In a cluster	Each device sends its own logs	Each device sends its own backups; in FTP/SCP, it writes to a subfolder with its own name in the remote directory
Typical destination	Syslog server, SIEM	Backup store, e-mail mailbox

Common Misconceptions

• "File Forwarding sends the logs as files." File Forwarding carries only backup files; the logs go with Log Forwarding.
• "Log Forwarding also sends vService traffic logs." The vService access and WAF logs go with the Logs profile assigned to the vService (What is Syslog; how are TR7 logs forwarded with Syslog?).
• "The E-Mail type of File Forwarding carries its own SMTP setting." The E-Mail type uses the global E-mail settings of the device; the recipients come from Contact groups in the profile.

How it is done in the documentation

• Log Forwarding · What Is Log Forwarding?
• File Forwarding · What Is File Forwarding?
• File Forwarding · How Does It Work?

Related questions

• What is Syslog; how are TR7 logs forwarded with Syslog?
• What is an audit log; where are administrator actions recorded in TR7?
• What is SMTP; with which settings does TR7 send e-mail notifications?