+ Logging, Syslog and Log Anaylsys Forums » Forums » Syslog & syslogd » syslog-ng
|-+ 

how to forward logs from a syslog-ng server to an UDP port

Username:
Password:
News:

Pages: [1]
0 Members and 1 Guest are viewing this topic. Topic Tools  
Read October 03, 2008, 11:38:33 am #0
kcsst

how to forward logs from a syslog-ng server to an UDP port

Hi Guru,

Appreciate if you could help

I installed syslog-ng in a Solaris 10 box. It is meant for logging firewall system messages from various locations. Furthermore, I need to forward the logs to a proprietary software for further analysis. The software reads the logs from port 10514.

I setup the syslog-ng.conf as

options {
          sync(0);
          keep_hostname(yes);
          long_hostnames(off);
          chain_hostnames(no);
          perm(0640);
          dir_perm(0750);
          create_dirs(yes);
          log_fifo_size(3000);
          time_sleep(0);
          use_dns(no);
        };

filter f_sidewinder_1   {  netmask(10.122.23.19/255.255.255.255);
};
destination d_sidewinder {  udp("10.122.70.18" port(10514) );
};
destination node1 { file("/diskpool/$HOST/$HOST.$R_YEAR-$R_MONTH-$R_DAY.fwlog");
};
source fw2 { udp(ip(10.122.70.14) port(514) );
};
log { source(fw2);  filter(f_sidewinder_1); destination(node1); destination(d_sidewinder);  };


It works fine in logging to the disk file. However, the messages forwarded to the port 10514 contain the "timestamp & hostname" of the syslog server. i.e

     [timestamp syslog IP] [timestamp host IP] message

As the message header is altered, the proprietary software fails.


Question:

How to get rid of the extra timestamp and syslog server IP when doing the forwarding?


Please advise. Thanks all in advance.


Kcsst
Offline  
Read October 06, 2008, 07:28:21 pm #1
mutex

Re: how to forward logs from a syslog-ng server to an UDP port

I am not really sure.  I would try posting the question on the syslog-ng developer list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Offline  
Pages: [1]
Jump to:  


Information Security News | Jerry Bell's blog | Enterprise IT | Tropical Fish Information | Tropical Fish Forums