Logging, Syslog and Log Anaylsys Forums
»
Forums
»
Syslog & syslogd
how to forward logs from a syslog-ng server to an UDP port
Username:
1 Hour
1 Day
1 Week
1 Month
Forever
Password:
Home
Help
Search
Quick Search
Advanced Search
Login
Register
News
:
« previous
next »
Pages: [
1
]
0 Members and 1 Guest are viewing this topic.
Topic Tools
Topic Tools
Print
October 03, 2008, 11:27:14 am
#0
kcsst
kcsst
Send kcsst an email.
Show kcsst's last posts.
Show general stats for kcsst.
Newbie
Posts: 2
how to forward logs from a syslog-ng server to an UDP port
Hi Guru,
Appreciate if you could help
I installed syslog-ng in a Solaris 10 box. It is meant for logging firewall system messages from various locations. Furthermore, I need to forward the logs to a proprietary software for further analysis. The software reads the logs from port 10514.
I setup the syslog-ng.conf as
options {
sync(0);
keep_hostname(yes);
long_hostnames(off);
chain_hostnames(no);
perm(0640);
dir_perm(0750);
create_dirs(yes);
log_fifo_size(3000);
time_sleep(0);
use_dns(no);
};
filter f_sidewinder_1 { netmask(10.122.23.19/255.255.255.255);
};
destination d_sidewinder { udp("10.122.70.18" port(10514) );
};
destination node1 { file("/diskpool/$HOST/$HOST.$R_YEAR-$R_MONTH-$R_DAY.fwlog");
};
source fw2 { udp(ip(10.122.70.14) port(514) );
};
log { source(fw2); filter(f_sidewinder_1); destination(node1); destination(d_sidewinder); };
It works fine in logging to the disk file. However, the messages forwarded to the port 10514 contain the "timestamp & hostname" of the syslog server. i.e
[timestamp syslog IP] [timestamp host IP] message
As the message header is altered, the proprietary software fails.
Question:
How to get rid of the extra timestamp and syslog server IP when doing the forwarding?
Please advise. Thanks all in advance.
Kcsst
Pages: [
1
]
« previous
next »
Jump to:
Please select a destination:
-----------------------------
Forums
-----------------------------
=> Syslog & syslogd
===> syslog-ng
=> Log Data and Analysis
=> Windows Event Log
=> Web Server Logs
=> Security
=> General Discussion
=> Red Light District
=> Logs, Sarbanes Oxley and Compliance
GoogleTagged:
syslog-ng udp port
syslog-ng forwarding
syslog-ng forward timestamp
syslog-ng udp destination
syslog-ng udp problem
syslog-ng change udp port
syslog-ng timestamp forwarding
syslog-ng
syslog-ng forward
syslog-ng forwarding
syslog forwarder timestamp
syslog-ng for
syslog-ng timestamp
syslog-ng forward
forwarder
solaris10 forward syslog
syslog-ng server
Information Security News
|
Jerry Bell's blog
|
Enterprise IT
|
Tropical Fish Information
|
Tropical Fish Forums
Loading...