topic Re: syslog with separate filenames in Network Security

syslog with separate filenames

cfajardo1_2 — Fri, 21 Feb 2020 11:01:44 GMT

scenario;

i have some 6 FWSM's in separate 6x6500 core switches..

requirement;

i need to log messages on my ACE "permit ip any any log" with separate filenames on a syslog server. how would my syslog config looks like.

Re: syslog with separate filenames

andrew.prince — Mon, 29 Sep 2008 07:44:09 GMT

You would need to configure your requirement on your syslog server.

If you run syslog-ng on Linux, your config would look like:-

destination d_switch { file("syslog-ng/switches/$HOST/$PRIORITY.$DAY-$MONTH-$YEAR.log"); };

HTH>

Re: syslog with separate filenames

cfajardo1_2 — Mon, 29 Sep 2008 17:39:29 GMT

sorry for not being so clear...

what i mean is the config on the FWSM

Re: syslog with separate filenames

andrew.prince — Mon, 29 Sep 2008 17:45:42 GMT

The platform makes no differnce, the fact it you configure the FWSM to send the syslogs to another device = syslog server.

In the syslog server you configure what you need.

You cannot tell the fwsm that you want the remote files to be saved in a particular format or with a specific name.....it just sends the syslog.

HTH>

Re: syslog with separate filenames

cfajardo1_2 — Tue, 30 Sep 2008 06:14:06 GMT

so how could we distinguish the logs from different fwsm

Re: syslog with separate filenames

andrew.prince — Tue, 30 Sep 2008 07:31:04 GMT

As previosuly posted - you need to configure the syslog server to filter and write the files according to your requirements.

HTH>

Re: syslog with separate filenames

cfajardo1_2 — Sat, 04 Oct 2008 08:58:43 GMT

i know that we have tp do simething on the syslog server.. what iam asking is the fwsm configuration.

Re: syslog with separate filenames

andrew.prince — Sat, 04 Oct 2008 11:03:33 GMT

read the below config guide:-

http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/monitr_f.html#wp1098912

HTH>

Re: syslog with separate filenames

cfajardo1_2 — Sat, 04 Oct 2008 18:01:33 GMT

Hi,

I found the solution, though not exactly but the idea is there..see the below thread

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=LAN%2C%20Switching%20and%20Routing&topicID=.ee71a04&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbf352d/1#selected_message

Re: syslog with separate filenames

andrew.prince — Sun, 05 Oct 2008 07:23:46 GMT

Yes - you can configure your nework devices to use "differenet" facility numbers, so your syslog server knows which device type is sending the syslog. it facility 17 is a firewall, facility 10 is a router.

BUT you STILL have to configure your syslog server to log the information by device name/ip address etc.

This cannot be done in the network device.

HTH>