topic If the syslog server is in Network Security

Sourcefire 's log didn't send to syslog server

Bill_Yang1227 — Sun, 10 Mar 2019 13:40:35 GMT

Dears

I have Cisco AMP 8150(5.4.0.1) + Virtual Firepower Management Center Data(5.4.0-763)

When I apply to device,and complete. my syslog server success received log.

But short time,mybe 1min,10min,30min...my syslog server not received log.

untill I apply to device and complete again......

Please HELP Me....

Thanks a lot

If the syslog server is

Hoyeh Tsai — Mon, 05 Sep 2016 02:56:38 GMT

If the syslog server is running with linux , you could use tcpdump command to make sure , is sourcefire not sending syslog , or the server syslog deamon not work?

if it's running with windows, you could use wireshark for figure out.

In fact,I have two syslog.

Bill_Yang1227 — Mon, 05 Sep 2016 03:32:21 GMT

In fact,I have two syslog.

one syslog server run HP arcsight.

another run 3CDaemon on windows is for test.

Two syslog server situation are same.....

Could you see the log from

Hoyeh Tsai — Tue, 06 Sep 2016 02:59:56 GMT

Could you see the log from connection and intrusion analysis?

if it work , accroding to your pic, i think your are config fine.

just make sure you've deploy the policy , and no firewall between sensor and syslog server,

or open nessery port.

if you do so , and still no log, i think you should open a case for troubleshooting.