Syslog ?! 1

[iiiiss]

HI !

I wanted to set up a syslog server to receive syslog messages from the PIX (515 with 6.2 (2))
I tried the syslogserver from cisco (pix firewall syslog server) but it received nothing!

It seems that the Pix isn´t sending anything to the syslog server !

I used "logging host inside 192.168.1.57 tcp/1470" .

What could i have done wrong ?

The PIX is working perfect with vpn and everything is going fine ..

Thx for the help

 

[gbiello]

Have you included:
logging on
logging trap warnings

-gbiello

 

[themut]

Check gbiello's reply. If it does not work try to use a different sylsog server like Kiwi. It listens on UDP 514 by default, so you will need:

logging on
logging trap <level>
logging host inside 192.168.1.57

That is all you need. Hope this helps!

 

[iiiiss]

Thank you for the response !

I tried the kiwi server and now it works....

 

[yizhar]

HI.

> I used &quot;logging host inside 192.168.1.57 tcp/1470&quot;
You should know that in the pix, using TCP instead of the default UDP, means that:
&quot;if you can't log it, don't do it&quot;.
Or in other words:
If the pix fails to contact the syslog server, it will stop forwarding any traffic.

If this is not what you want, use the default UDP syslog.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[AnonGod]

A follow-up on this -
I have a remote syslog server (Kiwi) that is not receiving any messages from my PIX.

logging on
logging trap informational
logging facility 23
logging host outside x.x.x.193

I also allow all ip traffic out.

Any help?

[TAG]
anongod@hotmail.com
&quot;Drawing on my fine command of language, I said nothing.&quot;

 

[cchipman]

Can you do a &quot;logging host outside&quot; command? That seems to me to be the kind of thing that they wouldn't allow... like telnet to the outside interface.

shouldn't it be to the inside interface?

 

[AnonGod]

Found it - it's the simple things that kill.
Firewall rule on my end, pointing to test server, not production syslog server.

Setting up the outside logging in PDM pops up a warning that it is not &quot;secure&quot; to log to the outside interface, but it does allow.

[TAG]
anongod@hotmail.com
&quot;Drawing on my fine command of language, I said nothing.&quot;