pix and multiple syslog-ng servers

we are about to hire an outside vendor to help us with intrusion prevention. they have requested our pix logs, which i have sent to a syslog-ng server. syslog-ng can forward logs on, but i believe it requires another syslog-ng client to accept the logs, which the vendor doesn't have. my question is whether the pix can send its logs to two syslog servers or whether issuing the command would replace the location where the logs currently are sent. my pix is in production, so i am not at liberty to just try things. thanks in advance to anyone who knows the answer.

Reply to
elinor
Loading thread data ...

You can download Kiwi Syslog to a PC and on the pix

conf t logging host 1.2.3.4 ctrl+z wri mem

where 1.2.3.4 is the IP of the machine with the syslog software.

Reply to
Chad Mahoney

Reply to
elinor

I do not recall the exact limit on the number of syslog destinations, but it is "several". I seem to recall seeing a figure of 10 mentioned in one of the 7.x releases.

To phrase more explicitly: yes, adding another "logging host" *will* cause the logs to be sent to both; it will *not* replace the original.

Reply to
Walter Roberson

Yes, it can. Syntax (based on v 6.3, should also be the same for 7.x, but verify if necessary) is [1] :

[no] logging host [in_if_name] ip_address [protocol /port] [format emblem]

so simply use

logging host ip-of-target-syslog-server

to enable logging to ip-of-target-syslog-server on default syslog port (UDP, 514). Repeat this command to add as many syslog server as you want.

You can also use the PIX Device Manager (PDM) to configure multiple syslog. Simply repeat the steps of "configure a syslog server " [2].

Michael

[1]
formatting link
formatting link
Reply to
Michael Meckelein

Reply to
elinor

formatting link
[2]

formatting link

Reply to
elinor

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.