remote syslog problem

[Guest]

[suk]

I have a windows box configured as a syslogger on 10.0.0.10 port 514 which I know to be working correctly.

I have a endian fw box (virtulaized on vmware workstation with 2 network interfaces - green [10.0.0.1] and red [192.168.0.1]).  On Endian I have set the syslog settings to Remote with the ip address of the syslogger 10.0.0.10. 

I am not recieving any syslog message from the Endian box....  I can ping the syslogger from the Endian box no problem....I have only one firewall rule which is allow any to any.

Any ideas anyone?

regards

Suk

[dimabar]

Some troubles in my EF install.... Please help!

[lightenup]

you can add this to the end of /etc/syslog/syslog.conf (obviously you would replace 172.16.1.1 with the ip of your syslog server):


#remote logging
destination d_loghost {udp("172.16.1.1" port(514));};
log { source(s_sys); destination(d_loghost); };


Once that is done restart syslog:

/etc/init.d/syslog-ng restart


That should do it. It looks like there is some problem with the web gui or the template file that generates the syslog.conf file. Keep in mind that if you make any changes to the syslog settings in the GUI this setting will likely be removed.

Lightenup

[lightenup]

I was poking around this morning and I found a better way to add the syslog entry in a way that it will not get over written. Create a file in /etc/syslog/syslog.d name it remote_syslog.tmpl and put the following contents in it:



#remote logging
destination d_loghost {udp("192.168.1.1" port(514));};
log { source(s_sys); destination(d_loghost); };



Now go to the web ui logs > settings and hit save. The tmpl config you created should now be included as part of the /etc/syslog/syslog.conf file, this will not get removed even after changing settings or reboots. Note, be sure to put some return characters  before and after the remote logging entries (above), otherwise the lines mights get wrapped in the final syslog.conf. Hope this helps.

[amtz83]

Hi there, I did this procedure on my EF but it not send anything to splunk


What can I do ?


Can someone help me ??