topic Re: Adding remote syslog server on vsx in Firewall and Security Management

Adding remote syslog server on vsx

Kai_Magnussen — Thu, 20 Aug 2020 07:28:47 GMT

hi,

I will be adding a remote syslog server to a vsx environment, in order to send messages entries to a splunk server.

Can this be added simply as a gaia command on each vs, or are there other considerations i need to take, when doing this?

If so, i will just add the commands as a one time script to each vs, and add necessary rules.

Re: Adding remote syslog server on vsx

PhoneBoy — Sat, 22 Aug 2020 05:46:41 GMT

I believe syslog from a VSX server is for the whole system and not for a specific VS.
Also, it will only get OS logs, not traffic logs.
For that you use Log Exporter from the MDS.

Re: Adding remote syslog server on vsx

Kai_Magnussen — Tue, 25 Aug 2020 07:25:22 GMT

hi,

So, i will just add the export of messages on vs0, and not every individual vs?

Log exporter will be the next step for the customer, after this is up and running.