Forwarding events from various devices through a syslog relay server to the Receiver requires additional steps.
You must add a single syslog relay data source to accept the stream of data and additional data sources. This allows the Receiver to split up the stream of data into the originating data sources. Sylog-ng and Splunk are supported. This diagram describes this scenario:
.png "GUID-08C759D0-B255-45FB-8896-6D0C90E815A7-low.png")
Cisco ASA Device
SourceFire Snort Device
TippingPoint Device
Syslog Relay
Data Source 1 — Syslog Relay
Data Source 2 — Cisco ASA
Data Source 3 — SourceFire Snort
Data Source 4 — TippingPoint
Using this scenario as an example, you must set up the syslog relay data source (5) to receive the stream of data from the syslog relay (4), selecting syslog in the Syslog relay field. Once the syslog relay data source is set up, add the data sources for the individual devices (6, 7, and 8), selecting None in the Syslog relay field, because this device is not a syslog relay server.
Note
Upload Syslog Messages does not work on a syslog relay setup.
The header on the syslog must be configured to look like the following example: 1 <123> 345 Oct 7 12:12:12 2012 Host_Name.com httpd[123]
where
|
| syslog version (optional) |
|
| syslog length (optional) |
|
| facility (optional) |
|
| date; hundreds of formats are supported (required) |
|
| hostname or ip address (ipv4 or ipv6) (required) |
|
| application name (optional) |
| [123] | application pid (optional) |
| : = | a colon (optional) |
Note
The host name and data fields can appear in either order. An IPv6 address can be enclosed in brackets [ ].