Forward IVX event notifications to a remote syslog server

Configure and send event notifications

Before you begin, ensure your system meets the following requirements:

To configure event notifications:

1. Enable the event notification service.

2. Add and configure an rsyslog server.

3. Verify the rsyslog configuration.

4. Monitor the MVX notification health status.

5. Test the connection to the rsyslog server.

6. Save your configuration.

1. Log in to the appliance and enter the CLI configuration mode.

   hostname > enable
   hostname # configure terminal

2. Enable the notification service. This command must be run only on a broker node. The configuration will then be automatically replicated across all broker nodes in the cluster.

   hostname (config)# mvx notify enable 

1. Add a new rsyslog server.

   hostname (config)# mvx notify rsyslog server <server-name> 

   Example: hostname (config) # mvx notify rsyslog server notifyserver

2. Specify the IP address or hostname and the port of your remote server.

   hostname (config)# mvx notify rsyslog server <server-name> host <ip_address/hostname> port <port_number>

   Example: hostname (config) # mvx notify rsyslog server notifyserver host 10.12.12.13 port 514

3. Select concise or normal JSON formats for the notification messages.

   • json-concise: Contains basic information such as the alert type, ID, malware name, and hostname.

   • json-normal: Contains more detailed information and abstracts without redundant data.

   hostname (config)# mvx notify rsyslog server <server-name> format <format>

   Example: hostname (config)# mvx notify rsyslog server notifyserver format json-concise

   Sample output (for Concise format):
   
   {"uuid": "3a119a2a-9a0d-4662-8a1e-b316059d4554","type":"dual","verdict":"malicious",
   "status":"success","name":"highrisk_WL-c8fb766a2b5749d1d22f8e1532565f9b-0.json",
   "md5":"15eceac6f09bcc8458c7c0916c902252","signature_name":"Malware.Parent.DUAL",
   "sha256":"370139e97a850e244f482e4cceb8f04b99fc029829094703357e0d9512324d01",
   "size":74240,"submission_time":"2025-10-27T04:47:53.142191",
   "complete_time":"2025-10-27T04:50:07.201963","submitter_name":"icap",
   "compute_node":"ivx167","submission_properties":{"is_sensor_sub":false,"analysis_type":"2","priority":"3"}}

   Note

   If the JSON message size exceeds 8 KB, the JSON structure may appear truncated or broken on the rsyslog server. To prevent this, you must increase the message size to maximum on the rsyslog server.

   For a detailed description of all available notification fields, refer to the JSON fields for the event notification table.

4. Set the transport protocol. You can send notifications using either TCP or UDP.

   hostname (config)# mvx notify rsyslog server <server-name> protocol <tcp/udp> 

   Example: hostname (config) # mvx notify rsyslog server notifyserver protocol tcp

5. Enable the server configuration. After defining the server details, you must enable it to begin sending notifications.

   hostname (config)# mvx notify rsyslog server <server-name> enable 

   Example: hostname (config) # mvx notify rsyslog server notifyserver enable

1. Run the show mvx notify config command.

2. Review the output to confirm the notification service is enabled and your rsyslog server details are listed correctly.

   Example output:

   Notification Status : Enabled 
   Rsyslog Server Configuration: 
    Server Name : notifyserver 
    Status : Enabled 
    Protocol : tcp 
    Host : 10.12.12.13 
    Port : 514
    Format : json-normal  

1. Execute the test command.

   hostname (config)# mvx notify test-fire 

2. Check the output for a success or failure message.

   Successful connection: UDP 10.128.84.146 -> Sent successfully

   Failed connection: TCP 10.128.84.146 -> connect error: Connection refused