CSPC sending syslogs to 192.168.0.1

[miralpatel91]

We are seeing logs on our firewalls that CSPC version 2.10.0.1 is sending syslogs to 192.168.0.1 IP address. We don't see any settings for syslog on server. Did anyone experienced this ? I want to set to correct syslog server or disable at last. We used to have CSPC version 2.8.1.5 before where we never saw this issue.

[neharani]

Hi,

I hope you are doing good.

I will be in charge of this post. I will get back to you in a personal message for further troubleshooting.

Regards,

Neha

[nmsicit01 · Accepted solution]

From root (log in to CLI as username collectorlogin then switch to root with command su root)
1. chkconfig rysylog off
2. systemctl stop rsyslog
3. reboot
Login again and verify the service is inactive (dead) and disabled and confirm the errant traffic has ceased from their traffic monitoring
4. systemctl status rsyslog
5. chkconfig rsyslog

[neharani · Accepted solution]

Hi,

The below-mentioned steps have already been shared with the user in a personal message. Now everything seems working fine as confirmed by the user.

chkconfig rsyslog

chkconfig rsyslog off

systemctl status rsyslog

systemctl stop rsyslog

After reboot check, the status and the service should be inactive/dead.

Regards,

Neha

[nmsicit01]

Thanks, Neha. Included here for the benefit of the community.
D