How does the Syslog Service work?

This article applies to:

• Firewall Suite

Question:

Information:

The purpose of the Syslog Service is to make firewall log files accessible to the Firewall Suite machine.  The Syslog daemon of the Firewall Suite Syslog Service collects firewall log data from the firewall via UDP 514.  The daemon collects the firewall data and creates a log file on the machine running WebTrends where they will remain until the user deletes them.

The Syslog Service standardizes the prefix of the firewall log file records. In the following example, the part of the firewall record that is formatted by Syslog Service appears in bold.

WTsyslog [2001-11-01 00:31:41 ip=192.168.9.1 pri=6] 304001 192.168.10.20 accessed URL 192.9.24.116:template/sunstyle.css

To verify that data is streaming to the Firewall Suite machine, click Tools | Monitor LEA/Syslog.  The program will find any traffic being collected by the WebTrends machine and display it in a small window.

If data is appearing in the syslog viewer but not being written to a log file, then the IP address specified in the "Firewall IP address" field in the profile editor is incorrect. Firewall Suite checks each syslog packet received for its originator and tries to match this to the Firewall IP address. This enables you to include data from more than one firewall in your report using syslog servers.  By looking at these packets and comparing their IP addresses, Firewall Suite can tell which syslog data packet belongs to which firewall.

Notes:

https://support.trustwave.com/Firewall-Suite/Documentation.asp

Because the Syslog Service runs as a Windows service, you must run Firewall Suite on a Windows NT, Windows 2000, Windows 2003, or Windows XP system and you must have administrator rights to configure the application to run as a service.

This article was previously published as:

NETIQKB7128