cisco sourcefire device

[techburn_@hotmail.com]

Hi all,

i would like to know how a cisco sourcefire device fetches the syslog itself to another syslog server?

thanks

[balaji.bandi]

if i understand correctly you looking offload the logs to syslog from sourcefire device (if not please correct me)

below guide help you to offload the load to external syslog server :

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118464-configure-firesight-00.html

[techburn_@hotmail.com]

Hi,

i just want the process on how the cisco sourcefire device fetch the log from a syslog server

[techburn_@hotmail.com]

Hi,

i just want the process on how the cisco sourcefire device fetch the log from a syslog server

thanks

[balaji.bandi]

which syslog server, can you give more explanation ?

[techburn_@hotmail.com]

Hi ,

the syslog server can be apache linux server or splunk server

[Marvin Rhoads · Accepted solution]

It may be a language issue in your question, but the Sourcefire device does not (and cannot) "fetch logs from a syslog server". It can send log messages to a syslog server.

The link Balaji provided describes how to do that. Any syslog server will work as long as it accepts RFC 5424 standard syslog messages.

As far as how it works, the appliance will simply encapsulate the messages in IP packets with destination address of the configured syslog server and destination port of udp/514.

[techburn_@hotmail.com]

Hi Marvin,

thanks you very much of your explanation