<br><br>Sandor, Good suggestion but I don't think it will work since syslog is UDP traffic. Also, it appears to be a very specific problem with our PIX firewall. This morning, our network engineer and I, set up a half dozen other devices, routers and switches, and they are all logging without any issue. So for now, I'm going to chalk this up as an issue with the PIX IOS, and consider this issue closed. Thanks again for everyone's help. This list is a true credit to the FOSS community.
<br><br>Mark<br><br><br><br><div><span class="gmail_quote">On 5/15/06, <b class="gmail_sendername">Sandor Geller</b> <<a href="mailto:wildy@balabit.hu">wildy@balabit.hu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Mark R. White wrote:<br><br>> My network engineer says he has our corporate pix box pointed to this<br>> server, yet I'm not getting any logs. Do I need to specify the facility<br>> that it's logging to? And if so, where do I specify that in this set
<br>> up? I assumed once I had it setup to log, and I was accepting external<br>> connections, it would log it into the file system as stated above and I<br>> wouldn't have to specify logging for each facility, local4 in this
<br>> specific case. Is it not correct to assume that since I have<br>> uncommented udp, all udp logging traffic would be defined by the s_all<br>> variable and forced to log the same as all other syslog data? Thanks
<br>> again for all of your help.<br><br>You don't have to know which facility the PIX is logging with. However<br>as the first debugging step I recommend using tcpdump to be sure whether<br>the PIX sends the log to the host properly or not.
<br><br>If the network packets seem to be OK, then see whether the hostname is<br>correct in the packets or not. Maybe the PIX log ends up somewhere in<br>the wrong system's log.<br><br>--<br>Sandor Geller<br><a href="mailto:wildy@balabit.hu">
wildy@balabit.hu</a><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br><br clear="all">
<br>-- <br>"Knowledge is power and I like power." Cobra Bubbles, Lilo & Stitch