This article applies to:

• Security Reporting Center 2.0

Question:

Procedure:

The following tips will assist troubleshooting Syslog forwarding agent problems on the firewall.

• Make any necessary modifications to the syslog output (in the case of firewalls that do not maintain logs), or make sure that the forwarding agent is set up and running on the firewall (in the case of firewalls that are forwarding the logs they create).

• If you are using the forwarding agent with a recent version of Raptor, be sure the vulture process is not killing the service. Check the services control panel to ensure that the log file forwarding agent is running.

• Also, be sure that a rule exists on the firewall permitting the machine where Security Reporting Center is installed to access port 514 via the UDP protocol.

• Make sure to restart the firewall service after making changes; sometimes, only a reboot will resynchronize the services and daemons.

The following tips will assist troubleshooting Syslog forwarding agent problems on the machine where Security Reporting Center is installed.

• Log on as administrator. Delete the IP_Address directory, a subfolder of the following directory:

  [Installation_Directory]/SyslogLogs

• Clear all profiles. Restart the machine. Verify that the Syslog Service has stopped or is not shown in the control panel.

• Create a new profile choosing Syslog when prompted, and use all other defaults. Verify that the service starts in the Control Panel.

• Verify that the IP_Address directory contains log files that are being updated.

Notes:

Please refer to the Firewall Configuration Guide for more information.

You can find a copy fo this document in PDF format on the Firewall Suite documentation page:

https://support.trustwave.com/Firewall-Suite/Documentation.asp

This article was previously published as:

NETIQKB13340