![]() You can check the status of the service with: Udp("10.40.5.146" port(514) template(no_head)) įile("/var/log/syslogtemp" template(no_head)) Īfter creating and saving this file, restart syslog-ng for the changes to take effect. Next, we filter the Syslog messages so that only the httpproxy events are forwarded.įilter f_utm-http \n") template_escape(no) ![]() Now that we are set up to receive messages, we can create some filters.įirst, we limit the messages that contain a source address that matches the subsidiary's 10.55.0.0/16 subnet. ![]() Configure syslog-ngīy default, syslog-ng will process configuration files contained within the following folder.įirst, let's set syslog-ng to listen for syslog messages on UDP port 514 with the following: There are a number of very good articles explaining how to setup an Ubuntu server, so I'll jump straight into the syslog configuration. I am using the Ubuntu Server distro for this. Since we cannot filter syslog data at the source or destination, we need to introduce a 'filtering syslog proxy' where we can apply the required filtering before passing it on to the destination.Īll Sophos UTM syslog data will be sent to the syslog proxy, then the proxy will forward messages that meet the filtering criteria (the subsidiary's subnet) on to Fastvue Sophos Reporter instance that only needs data for the subsidiary.įor the syslog proxy, we can use a simple Linux box running syslog-ng. But if bandwidth is a consideration, you definitely want to drop the very large streams of firewall and reverse proxy logs. The live dashboards will also display all traffic as these cannot be filtered currently.įastvue Sophos Reporter will reject syslog data that is not of the 'web filter' format, so sending the extraneous logs is not a problem for disk space. Both Fastvue Sophos Reporter instances only require the Web Filtering (http) logs.Īlthough Fastvue Sophos Reporter can filter reports and alerts by subdivision or subsidiary (defined as IP subnets), it will still import and store all web filtering log data, consuming unnecessary bandwidth and disk space. One instance reports on the organization as a whole while the other only reports on a subdivision or subsidiary.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |