<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-US" link="#0563C1" vlink="#954F72"><div class="WordSection1"><p class="MsoNormal">Syslog-ng experts.</p><p class="MsoNormal"> I am very new to syslog-ng. I installed syslog-ng on a fresh Redhat 7.3 server. It defaults working with internal logging. So I configured my firewall to send syslog with facility set to log_user. I turned on Wireshark on the syslog-ng server and observed the firewall sending traffic to the server on udp 514. </p><p class="MsoNormal"> </p><p class="MsoNormal">But the syslog server never created the directory structure and logs. I disabled the redhat firewall just to eliminate it as a possibility. Still no logging. So I don’t know what I am doing wrong at this point. I don’t know if this is a permission problem or some other configuration issue. I found someone that had posted a very basic syslog-ng configuration for firewalls. So I copied It into a firewall.conf I put in conf.d. Can anyone see what might be wrong with it?</p><p class="MsoNormal"> </p><p class="MsoNormal">####################</p><p class="MsoNormal">options {</p><p class="MsoNormal"> create_dirs(yes);</p><p class="MsoNormal"> owner(root);</p><p class="MsoNormal"> group(root);</p><p class="MsoNormal"> perm(0640);</p><p class="MsoNormal"> dir_owner(root);</p><p class="MsoNormal"> dir_group(root);</p><p class="MsoNormal"> dir_perm(0750);</p><p class="MsoNormal">};</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">##################################################</p><p class="MsoNormal">source s_udp {</p><p class="MsoNormal"> udp(port(514));</p><p class="MsoNormal">};</p><p class="MsoNormal"> </p><p class="MsoNormal">#Template for a new firewall in the firewalls.conf file</p><p class="MsoNormal">#Entries to be changed: NAMEOFTHEFIREWALL and IPOFTHEFIREWALL</p><p class="MsoNormal"> </p><p class="MsoNormal">##################################################</p><p class="MsoNormal">filter f_NAMEOFTHEFIREWALL {</p><p class="MsoNormal"> host("192.168.30.1");</p><p class="MsoNormal">};</p><p class="MsoNormal">destination d_NAMEOFTHEFIREWALL {</p><p class="MsoNormal"> file("/var/log/firewalls/PA/$YEAR/$MONTH/$YEAR-$MONTH-$DAY.PA.log");</p><p class="MsoNormal">};</p><p class="MsoNormal">log {</p><p class="MsoNormal"> source(s_udp);</p><p class="MsoNormal"> filter(f_NAMEOFTHEFIREWALL);</p><p class="MsoNormal"> destination(d_NAMEOFTHEFIREWALL);</p><p class="MsoNormal">};</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">Tim Tyler</p><p class="MsoNormal">Network Engineer</p><p class="MsoNormal">Beloit College</p><p class="MsoNormal"> </p></div></body></html>