Can you have WSA send logs to a syslog server and still use a SMA for Centralized Reporting

[rhnetworkteam]

We are looking at getting our WSA logs into Splunk to create Dashboards and ease of access for our IT Manager to be able to look at Bandwidth utilization easier. I was wondering can we have the logs go to syslog as well as leverage Centralized Reporting to an SMA?

Any help would be appreciated.

Thanks,

[balaji.bandi]

here is the sample screen and config to send logs it  is old but still works.

http://www.balajibandi.com/2017/10/01/wsa-logs-to-syslog-server-for-kibana-logstash/

[Josiane de Barros Silva]

Hi  rhnetworkteam

You can also use Add-on to use the Splunk SIEM system.

https://www.splunk.com/pdfs/partner-briefs/splunk-and-cisco.pdf

Best regards,

Josiane

[rhnetworkteam]

Yes, I understand on how to set it up to send to the syslog... but what I am asking is that do the logs still get sent to the SMA as well as the syslog server.

[Josiane de Barros Silva]

Hi rhnetworkteam

I gave one a search and I did not find anything about it.
It would be interesting to open a case on the TAC, I believe that you would quickly have that answer.
And share your feedback with us

Best Regards,

Josiane

[Ken Stieers]

I would leave the default log in place and then build a second log subscription that gets sent to syslog.

I'd have to test it, but my assumption would be that if you send to syslog, the log doesn't stay around for the SMA to pick it up.

[balaji.bandi]

yes you can do both places, that what i refered the before document in the post.

[Todd Everett]

I can confirm that when you add a new log on the WSA (being rebranded as Secure Web Appliance - SWA), it runs independently of the other logging. The prior references in this thread and documentation cover connection options for the syslog server.

[amojarra]

Hello @rhnetworkteam 

the main concerns is about Reports being in two place, which can not be done. Just in SWA or in one or two SMA(s) at the same time.

regarding the Logs, you dont have any limitation on creating log subscription and pushing/ forwarding the logs anywhere you want, On the SWA, on FTP, SCP, Syslog ,... . and multiple instance at the same time for the same log

Just please consider the load on the Network interface and Disk if you are configuring many log servers and consider the log levels please (in case device didn't get overload or busy ....)

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++