topic Setting a syslog facility code in cp_log_export? in Firewall and Security Management

Setting a syslog facility code in cp_log_export?

Mattias_Jansson — Mon, 27 Jul 2020 08:34:07 GMT

Hi!

I have tried to find a way to set a specific syslog Facility code for my auditlogs with the the cp_log_export function, but I cannot find that feature. It seems to use the default Facility code 0 by default.
Does anyone know if this is possible or planned for any coming releases?

Regards

Mattias Jansson

Re: Setting a syslog facility code in cp_log_export?

G_W_Albrecht — Mon, 27 Jul 2020 08:54:22 GMT

I think this was/is possible with sk115392: How to export Check Point logs to a Syslog server using CPLogToSyslog :

(7-B) Syslog Indicators - Facility Indicators

The following table shows the values and meanings of Facility Indicators that are used in the event_format section of the policy file
(refer to section "(5-E) Configuration instructions - Rulebase").

The Facility Indicators are used to specify what type of program is logging the message.
This lets the administrator specify that messages from different facilities should be handled differently
(refer to https://linux.die.net/man/5/syslog.conf).

Re: Setting a syslog facility code in cp_log_export?

Mattias_Jansson — Mon, 27 Jul 2020 12:33:36 GMT

Interesting.
That seems to be the older tool that was supported until R80.10.
We are on R80.20.
So I hope that the possibility to set the facility indicator will be implemented in coming relases of the new feature.

Re: Setting a syslog facility code in cp_log_export?

G_W_Albrecht — Wed, 29 Jul 2020 08:43:36 GMT

I have now found this: sk87560: How to configure Security Gateway on Gaia OS to send FireWall logs to an external Syslog server Technical Level