we are about to hire an outside vendor to help us with intrusion prevention. they have requested our pix logs, which i have sent to a syslog-ng server. syslog-ng can forward logs on, but i believe it requires another syslog-ng client to accept the logs, which the vendor doesn't have. my question is whether the pix can send its logs to two syslog servers or whether issuing the command would replace the location where the logs currently are sent. my pix is in production, so i am not at liberty to just try things. thanks in advance to anyone who knows the answer.
pix and multiple syslog-ng servers
Oct 25, 2006
6 Replies
You can download Kiwi Syslog to a PC and on the pix
conf t logging host 1.2.3.4 ctrl+z wri mem
where 1.2.3.4 is the IP of the machine with the syslog software.
I do not recall the exact limit on the number of syslog destinations, but it is "several". I seem to recall seeing a figure of 10 mentioned in one of the 7.x releases.
To phrase more explicitly: yes, adding another "logging host" *will* cause the logs to be sent to both; it will *not* replace the original.
Yes, it can. Syntax (based on v 6.3, should also be the same for 7.x, but verify if necessary) is [1] :
[no] logging host [in_if_name] ip_address [protocol /port] [format emblem]so simply use
logging host ip-of-target-syslog-server
to enable logging to ip-of-target-syslog-server on default syslog port (UDP, 514). Repeat this command to add as many syslog server as you want.
You can also use the PIX Device Manager (PDM) to configure multiple syslog. Simply repeat the steps of "configure a syslog server " [2].
Michael
[1]
formatting link
formatting link
formatting link
[2]
formatting link
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required