While troubleshooting a network connectivity issue, an administrator determines that a device was being automatically provisioned to an incorrect VLAN.
Where would the administrator look to determine when and why FortiNAC made the network access change?

Which two things must be done to allow FortiNAC to process incoming syslog messages from an unknown vendor? (Choose two.)