topic Re: cisco sourcefire device in Network Security

cisco sourcefire device

techburn_@hotmail.com — Fri, 15 Mar 2019 07:05:29 GMT

Hi all,

i would like to know how a cisco sourcefire device fetches the syslog itself to another syslog server?

thanks

Re: cisco sourcefire device

balaji.bandi — Fri, 15 Mar 2019 08:44:15 GMT

if i understand correctly you looking offload the logs to syslog from sourcefire device (if not please correct me)

below guide help you to offload the load to external syslog server :

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118464-configure-firesight-00.html

Re: cisco sourcefire device

techburn_@hotmail.com — Fri, 15 Mar 2019 09:36:07 GMT

Hi,

i just want the process on how the cisco sourcefire device fetch the log from a syslog server

Re: cisco sourcefire device

techburn_@hotmail.com — Fri, 15 Mar 2019 09:36:54 GMT

Hi,

i just want the process on how the cisco sourcefire device fetch the log from a syslog server

thanks

Re: cisco sourcefire device

balaji.bandi — Fri, 15 Mar 2019 10:08:51 GMT

which syslog server, can you give more explanation ?

Re: cisco sourcefire device

techburn_@hotmail.com — Sun, 17 Mar 2019 04:06:52 GMT

Hi ,

the syslog server can be apache linux server or splunk server

Re: cisco sourcefire device

Marvin Rhoads — Sun, 17 Mar 2019 05:23:09 GMT

It may be a language issue in your question, but the Sourcefire device does not (and cannot) "fetch logs from a syslog server". It can send log messages to a syslog server.

The link Balaji provided describes how to do that. Any syslog server will work as long as it accepts RFC 5424 standard syslog messages.

As far as how it works, the appliance will simply encapsulate the messages in IP packets with destination address of the configured syslog server and destination port of udp/514.

Re: cisco sourcefire device

techburn_@hotmail.com — Mon, 18 Mar 2019 09:45:35 GMT

Hi Marvin,

thanks you very much of your explanation