This article applies to:
Question:
How does the Syslog Service work?
Information:
The purpose of the Syslog Service is to make firewall log files accessible to the Firewall Suite machine. The Syslog daemon of the Firewall Suite Syslog Service collects firewall log data from the firewall via UDP 514. The daemon collects the firewall data and creates a log file on the machine running WebTrends where they will remain until the user deletes them.
The Syslog Service standardizes the prefix of the firewall log file records. In the following example, the part of the firewall record that is formatted by Syslog Service appears in bold.
WTsyslog [2001-11-01 00:31:41 ip=192.168.9.1 pri=6] 304001 192.168.10.20 accessed URL 192.9.24.116:template/sunstyle.css
To verify that data is streaming to the Firewall Suite machine, click Tools | Monitor LEA/Syslog. The program will find any traffic being collected by the WebTrends machine and display it in a small window.
If data is appearing in the syslog viewer but not being written to a log file, then the IP address specified in the "Firewall IP address" field in the profile editor is incorrect. Firewall Suite checks each syslog packet received for its originator and tries to match this to the Firewall IP address. This enables you to include data from more than one firewall in your report using syslog servers. By looking at these packets and comparing their IP addresses, Firewall Suite can tell which syslog data packet belongs to which firewall.
Notes:
The firewall must be configured to use the Syslog Service. Please refer to the Firewall Configuration Guide for instruction. The guide can be found on the following Documentation page:
https://support.trustwave.com/Firewall-Suite/Documentation.asp
Because the Syslog Service runs as a Windows service, you must run Firewall Suite on a Windows NT, Windows 2000, Windows 2003, or Windows XP system and you must have administrator rights to configure the application to run as a service.
- This article was previously published as:
- NETIQKB7128
