This article applies to:
- WebMarshal 7.4.0 and above
- Syslog functionality
Question:
- How do I enable logging of request data to Syslog in WebMarshal?
Procedure:
To enable sending of request data to a Syslog server, add the following entry to the WMEngine.config.xml file, within the WebMarshal install on each processing server:
<WebMarshal>
<Engine>
<Config>
<Syslog enabled="true" address="[server IP or hostname]"
port="[server port]" protocol="[protocol]"/>
</Config>
</Engine>
</WebMarshal>
where
[server IP or hostname] is a string
[server port] is an integer. Default: 514 if protocol is UDP; 601 if protocol is TCP
[protocol] is an integer (0 for UDP, 1 for TCP). Default: 0 (UDP)
Include the quote marks but not brackets.
To apply the change, restart the Engine service.
To stop the Syslog delivery, remove this entry, or set the value of enabled to "false", and then restart the Engine.
Data format:
Records are logged with Facility 1 (user-level) and Severity 6 (Informational).
The record begins with the Process ID of the WebMarshal Engine service.
The logger name is "root".
The remaining data sent in Syslog records is the same information and format provided in WELF Traffic Logging records. For details, see Trustwave Knowledgebase article Q21119.
A sample record is as below:
3216 root - INFO - id=WebMarshal time="2019-10-22 10:21:01" fw=TEST1 pri=6 src=192.168.17.134 srcname=myclient dst=192.168.164.7 dstname=internalsite.local proto=80 sent=0 rcvd=28 cat_action=pass user=mydomain\user1 arg=/favicon.ico agent="Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" op=GET filetype=XML contenttype=text/html scheme=http wmcache=MISS scode=503 dclass="Unknown URLs"
Notes:
- If the file contains other settings, be sure to retain them.
- Note that XML configuration files are case sensitive. See article Q12705