<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7650.28">
<TITLE>Forwarding to a Loglogic device</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<BR>
<P><FONT SIZE=2 FACE="Arial">Argh…</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Can someone tell me why a sniffer shows no traffic passing to the destination when using this config?</FONT>
<BR><FONT SIZE=2 FACE="Arial">I've tried everything I can think of…what am I doing wrong?</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">##############################</FONT>
<BR><FONT SIZE=2 FACE="Arial"># Loglogic dump </FONT>
<BR><FONT SIZE=2 FACE="Arial">##############################</FONT>
<BR><FONT SIZE=2 FACE="Arial">options {</FONT>
<BR><FONT SIZE=2 FACE="Arial">sync(0);</FONT>
<BR><FONT SIZE=2 FACE="Arial">log_fifo_size(1024);</FONT>
<BR><FONT SIZE=2 FACE="Arial">chain_hostnames(no);</FONT>
<BR><FONT SIZE=2 FACE="Arial">use_fqdn(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial">use_dns(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial">dns_cache(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial">dns_cache_expire(300);</FONT>
<BR><FONT SIZE=2 FACE="Arial">dns_cache_expire_failed(10);</FONT>
<BR><FONT SIZE=2 FACE="Arial">dns_cache_size(1024);</FONT>
<BR><FONT SIZE=2 FACE="Arial">keep_hostname(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
<BR><FONT SIZE=2 FACE="Arial">source snet { tcp(); udp(); };</FONT>
<BR><FONT SIZE=2 FACE="Arial">filter f_loglogic { level(debug..emerg) and facility(local0, local1, local2, local3, local4, local6, local7); };</FONT>
<BR><FONT SIZE=2 FACE="Arial">destination LogLogic { tcp("10.24.2.39" port(514) log_fifo_size(60000) template("<$PRI> $R_DATE $SOURCEIP $MSG\n") ); };</FONT></P>
<P><FONT SIZE=2 FACE="Arial">log { source(snet); filter(f_loglogic); destination(LogLogic); };</FONT>
<BR><FONT SIZE=2 FACE="Arial">##############################</FONT>
<BR><FONT SIZE=2 FACE="Arial"># END Loglogic dump </FONT>
<BR><FONT SIZE=2 FACE="Arial">##############################</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">When I telnet to my router and generate a SYS-5-CONFIG, I see the packet come into the server:</FONT>
<BR><FONT SIZE=2 FACE="Arial">#----Start capture</FONT>
<BR><FONT SIZE=2 FACE="Arial">tcpdump dst port 514 </FONT>
<BR><FONT SIZE=2 FACE="Arial">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</FONT>
<BR><FONT SIZE=2 FACE="Arial">listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">10:17:33.211813 IP 10.26.31.2.52935 > syslog.net.syslog: SYSLOG local7.notice, length: 105</FONT>
<BR><FONT SIZE=2 FACE="Arial">148 packets captured</FONT>
<BR><FONT SIZE=2 FACE="Arial">297 packets received by filter</FONT>
<BR><FONT SIZE=2 FACE="Arial">0 packets dropped by kernel</FONT>
<BR><FONT SIZE=2 FACE="Arial">#----End capture</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">But when I try to sniff packets going to the destination server, I see nothing:</FONT>
<BR><FONT SIZE=2 FACE="Arial"> /etc/init.d/syslog-ng restart </FONT>
<BR><FONT SIZE=2 FACE="Arial"> * Stopping syslog-ng ... [ ok ]</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> * Starting syslog-ng ... </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">#----Start capture - note that the entries below are from syslog-ng restarting, so I know it establishes a connection...</FONT></P>
<P><FONT SIZE=2 FACE="Arial">tcpdump dst host 10.24.2.39 </FONT>
<BR><FONT SIZE=2 FACE="Arial">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</FONT>
<BR><FONT SIZE=2 FACE="Arial">listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">10:24:40.401037 IP syslog.net.56631 > .shell: F 1487912722:1487912722(0) ack 91904650 win 1460 <nop,nop,timestamp 866281169 157842259></FONT></P>
<P><FONT SIZE=2 FACE="Arial">10:24:40.407670 IP syslog.net.56631 > .shell: . ack 2 win 1460 <nop,nop,timestamp 866281177 158151244></FONT>
<BR><FONT SIZE=2 FACE="Arial">10:24:43.014989 IP syslog.net.42848 > .shell: S 1805017512:1805017512(0) win 5840 <mss 1460,sackOK,timestamp 866283785 0,nop,wscale 2></FONT></P>
<P><FONT SIZE=2 FACE="Arial">10:24:43.015885 IP syslog.net.42848 > .shell: . ack 425051406 win 1460 <nop,nop,timestamp 866283786 158153852></FONT>
<BR><FONT SIZE=2 FACE="Arial">#----End capture</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">What am I missing here?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Thanks!</FONT>
<BR><FONT SIZE=2 FACE="Arial">Clayton</FONT>
</P>
<BR>
</BODY>
</HTML>