cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
gpotenza
Level 8
Report Inappropriate Content
Message 1 of 4

How to send different access.logs to multiple syslog server

Jump to solution

Dear community,

hope you're doing well! 

my goal is to send access-logs for Siem to Syslogserver 1 and another type of access-logs (splunk related content) to Syslogserver 2.

Any ideas how to implement?

All the best,

Giuseppe

1 Solution

Accepted Solutions
gpotenza
Level 8
Report Inappropriate Content
Message 4 of 4

Re: How to send different access.logs to multiple syslog server

Jump to solution

Hi,

it looks like the only way to solve this, is to configure one log to be send to Syslog severity level 5 (notice) and the other one on syslog severity level 6 (informational) 

Thanks to McAfee support for providing this solution:

SEND SYSLOG TO TWO LOCATIONS EACH WITH UNIQUE FORMATS (Level 6 and Level 5)
- First use best practices to create 1 syslog
- Configure or import two unique log formats under: Policy > Log Handler
- Use syslog Event for one of them with severity 6 (info) Syslog (6, User-Defined.logLine)
- Use syslog Event for the other severity 5 (notice) Syslog (5, User-Defined.logLine)

In rsyslog.conf, exclude both from writing to local disk:
*.info;daemon.!=info;daemon.!=notice;mail.none;authpriv.none;cron.none -/var/log/messages
(This line should already be existing)

And send each stream to its respective recipient using TCP (UDP would be a single @):
daemon.notice @@IP:514
daemon.info;daemon.!=notice @@IP:514
[If you do not include ";daemon.!=notice" in the @@ line, both info & notice will get sent to the "notice" destination.]

Best regards,

Giuseppe

 

View solution in original post

3 Replies
Dan28
Level 7
Report Inappropriate Content
Message 2 of 4

Re: How to send different access.logs to multiple syslog server

Jump to solution

Hello,

In our deployment, we added several entries in the rsyslog.conf with syslog servers (via gui, Configuration > File Editor), it does the trick. Hope it helps.

Regards,

gpotenza
Level 8
Report Inappropriate Content
Message 3 of 4

Re: How to send different access.logs to multiple syslog server

Jump to solution

Hi,

how did you decide which logfile is send to which Syslog-Server? As both the logfiles are set/send to Syslog Level 6. Did you specify an trigger to separate them?

Thanks and greets,

Giuseppe

 

gpotenza
Level 8
Report Inappropriate Content
Message 4 of 4

Re: How to send different access.logs to multiple syslog server

Jump to solution

Hi,

it looks like the only way to solve this, is to configure one log to be send to Syslog severity level 5 (notice) and the other one on syslog severity level 6 (informational) 

Thanks to McAfee support for providing this solution:

SEND SYSLOG TO TWO LOCATIONS EACH WITH UNIQUE FORMATS (Level 6 and Level 5)
- First use best practices to create 1 syslog
- Configure or import two unique log formats under: Policy > Log Handler
- Use syslog Event for one of them with severity 6 (info) Syslog (6, User-Defined.logLine)
- Use syslog Event for the other severity 5 (notice) Syslog (5, User-Defined.logLine)

In rsyslog.conf, exclude both from writing to local disk:
*.info;daemon.!=info;daemon.!=notice;mail.none;authpriv.none;cron.none -/var/log/messages
(This line should already be existing)

And send each stream to its respective recipient using TCP (UDP would be a single @):
daemon.notice @@IP:514
daemon.info;daemon.!=notice @@IP:514
[If you do not include ";daemon.!=notice" in the @@ line, both info & notice will get sent to the "notice" destination.]

Best regards,

Giuseppe

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community