How does the Syslog Monitor work?

This article applies to:

• WebTrends Firewall Suite 3.X
• WebTrends Firewall Suite 4.X

Question:

Symptoms:

• The log file has not been created even though data can be seen streaming through the Syslog Monitor.

Causes:

The Syslog Monitor displays all traffic that it sees on UDP port 514, regardless of the source. However, the Firewall Suite Syslog client will not add data to a log file unless the source of the data on UDP port 514 is the firewall address that was specified in the profiles.

The most common situation that will lead to this issue is when the IP address specified in Firewall Suite as belonging to the firewall is not the IP address of the firewall's LAN-side NIC, but is instead either the IP address of the external NIC or just an incorrect IP address. Other potential problems could be related to network access, file permissions, and the use of mapped drives in the syslog "save as" file path.

Information:

1. Verify that the IP address specified in the profile is the same IP address the Firewall is using to send log information. Test by making a new profile and specify the alternate Firewall IP addresses.

2. Look for possible file permissions and/or network access issues.

   • Remember that system accounts often do not have network access. If you have specified an alternate location for log files to be created, for testing purposes, select a log file location on the same drive as the Firewall Suite installation directory.

   • Instead of using a mapped drive, use a UNC path.

This article was previously published as:

NETIQKB1298